Analysis
-
max time kernel
899s -
max time network
898s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
21-12-2024 12:22
General
-
Target
ANYX-client-build/AnyLoaderV4.9.exe
-
Size
3.1MB
-
MD5
9a99be1ac8e21a3c4959702a02b25d6e
-
SHA1
55d6230481e90c8a2f9d09956c07e3db1d03a96d
-
SHA256
e26918aac1a313925a7aecdaeb1990788cd2e09e439cd3e5fe8d6babb89df0f1
-
SHA512
46ae9d4d95c89afb3ed987445dcf72c71e770e99c35759a724e963952784d518530b2829b856b7818a8bc226e35fa8f243e18e35da4d7169c44edc5303159ea4
-
SSDEEP
49152:rvelL26AaNeWgPhlmVqvMQ7XSKodL5mzSooGdw9THHB72eh2NT:rvOL26AaNeWgPhlmVqkQ7XSKodL0A
Malware Config
Extracted
quasar
1.4.1
Office04
rolok44419-55109.portmap.host:55109
0bcbf378-c5c6-4d35-b7db-11442a750cf2
-
encryption_key
A1C7F8E92E515420A946C210E4F8C886810ADBFD
-
install_name
AnyLoaderV4.9.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svchost
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/4604-1-0x00000000009E0000-0x0000000000D04000-memory.dmp family_quasar behavioral1/files/0x0029000000046159-3.dat family_quasar -
A potential corporate email address has been identified in the URL: [email protected]
-
A potential corporate email address has been identified in the URL: [email protected]
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation AnyLoaderV4.9.exe -
Executes dropped EXE 64 IoCs
pid Process 3936 AnyLoaderV4.9.exe 4464 AnyLoaderV4.9.exe 3644 AnyLoaderV4.9.exe 4644 AnyLoaderV4.9.exe 4644 AnyLoaderV4.9.exe 4892 AnyLoaderV4.9.exe 5448 AnyLoaderV4.9.exe 5732 AnyLoaderV4.9.exe 5464 AnyLoaderV4.9.exe 3936 AnyLoaderV4.9.exe 5416 AnyLoaderV4.9.exe 3360 AnyLoaderV4.9.exe 632 AnyLoaderV4.9.exe 5800 AnyLoaderV4.9.exe 5136 AnyLoaderV4.9.exe 3460 AnyLoaderV4.9.exe 568 AnyLoaderV4.9.exe 4440 AnyLoaderV4.9.exe 5712 AnyLoaderV4.9.exe 1320 AnyLoaderV4.9.exe 3736 AnyLoaderV4.9.exe 4964 AnyLoaderV4.9.exe 5712 AnyLoaderV4.9.exe 1928 AnyLoaderV4.9.exe 1032 AnyLoaderV4.9.exe 4972 AnyLoaderV4.9.exe 2520 AnyLoaderV4.9.exe 2476 AnyLoaderV4.9.exe 4656 AnyLoaderV4.9.exe 3252 AnyLoaderV4.9.exe 5616 AnyLoaderV4.9.exe 7640 AnyLoaderV4.9.exe 7880 AnyLoaderV4.9.exe 5260 AnyLoaderV4.9.exe 4588 AnyLoaderV4.9.exe 2916 AnyLoaderV4.9.exe 5936 AnyLoaderV4.9.exe 6320 AnyLoaderV4.9.exe 6576 AnyLoaderV4.9.exe 6832 AnyLoaderV4.9.exe 7140 AnyLoaderV4.9.exe 7376 AnyLoaderV4.9.exe 7932 AnyLoaderV4.9.exe 5512 AnyLoaderV4.9.exe 8080 AnyLoaderV4.9.exe 5500 AnyLoaderV4.9.exe 5992 AnyLoaderV4.9.exe 8104 AnyLoaderV4.9.exe 6176 AnyLoaderV4.9.exe 6336 AnyLoaderV4.9.exe 6440 AnyLoaderV4.9.exe 1516 AnyLoaderV4.9.exe 7300 AnyLoaderV4.9.exe 5900 AnyLoaderV4.9.exe 3948 AnyLoaderV4.9.exe 7492 AnyLoaderV4.9.exe 6100 AnyLoaderV4.9.exe 2796 AnyLoaderV4.9.exe 5088 AnyLoaderV4.9.exe 2004 AnyLoaderV4.9.exe 5896 AnyLoaderV4.9.exe 6112 AnyLoaderV4.9.exe 4328 AnyLoaderV4.9.exe 5792 AnyLoaderV4.9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4168 PING.EXE 8072 PING.EXE 732 PING.EXE 7064 PING.EXE 6508 PING.EXE 7592 PING.EXE 6152 PING.EXE 6692 PING.EXE 3736 PING.EXE 5964 PING.EXE 7844 PING.EXE 4016 PING.EXE 5776 PING.EXE 2000 PING.EXE 1000 PING.EXE 5068 PING.EXE 7636 PING.EXE 4280 PING.EXE 840 PING.EXE 6488 PING.EXE 1468 PING.EXE 7096 PING.EXE 6348 PING.EXE 6612 PING.EXE 932 PING.EXE 7572 PING.EXE 5888 PING.EXE 4916 PING.EXE 4764 PING.EXE 6484 PING.EXE 7100 PING.EXE 6128 PING.EXE 5320 PING.EXE 1672 PING.EXE 896 PING.EXE 1032 PING.EXE 7740 PING.EXE 2564 PING.EXE 3000 PING.EXE 6140 PING.EXE 568 PING.EXE 5756 PING.EXE 1096 PING.EXE 6084 PING.EXE 2312 PING.EXE 5692 PING.EXE 2688 PING.EXE 4648 PING.EXE 5816 PING.EXE 3736 PING.EXE 7300 PING.EXE 5896 PING.EXE 7708 PING.EXE 6632 PING.EXE 728 PING.EXE 5700 PING.EXE 5748 PING.EXE 6780 PING.EXE 8124 PING.EXE 7264 PING.EXE 3100 PING.EXE 5700 PING.EXE 800 PING.EXE 4168 PING.EXE -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings firefox.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\ANYX-client-build.zip:Zone.Identifier firefox.exe -
Runs ping.exe 1 TTPs 64 IoCs
pid Process 1672 PING.EXE 3008 PING.EXE 3100 PING.EXE 5308 PING.EXE 1600 PING.EXE 6612 PING.EXE 4180 PING.EXE 5964 PING.EXE 5804 PING.EXE 5068 PING.EXE 1220 PING.EXE 3736 PING.EXE 4916 PING.EXE 4764 PING.EXE 4280 PING.EXE 6692 PING.EXE 932 PING.EXE 3000 PING.EXE 3420 PING.EXE 5320 PING.EXE 7636 PING.EXE 4168 PING.EXE 5320 PING.EXE 6348 PING.EXE 4440 PING.EXE 7300 PING.EXE 2312 PING.EXE 7636 PING.EXE 1152 PING.EXE 4656 PING.EXE 2308 PING.EXE 800 PING.EXE 6780 PING.EXE 4688 PING.EXE 7740 PING.EXE 728 PING.EXE 5700 PING.EXE 5700 PING.EXE 7844 PING.EXE 8124 PING.EXE 2564 PING.EXE 6128 PING.EXE 5740 PING.EXE 7100 PING.EXE 5748 PING.EXE 8 PING.EXE 5888 PING.EXE 7592 PING.EXE 5692 PING.EXE 2688 PING.EXE 6632 PING.EXE 7572 PING.EXE 3736 PING.EXE 840 PING.EXE 5896 PING.EXE 4400 PING.EXE 6152 PING.EXE 5760 PING.EXE 568 PING.EXE 7064 PING.EXE 1000 PING.EXE 6488 PING.EXE 3628 PING.EXE 7056 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5272 schtasks.exe 6844 schtasks.exe 3280 schtasks.exe 4480 schtasks.exe 1800 schtasks.exe 5620 schtasks.exe 2308 schtasks.exe 1992 schtasks.exe 7668 schtasks.exe 5724 schtasks.exe 5320 schtasks.exe 5492 schtasks.exe 5804 schtasks.exe 6296 schtasks.exe 2520 schtasks.exe 7040 schtasks.exe 7904 schtasks.exe 3284 schtasks.exe 5920 schtasks.exe 4032 schtasks.exe 6180 schtasks.exe 2292 schtasks.exe 5440 schtasks.exe 4536 schtasks.exe 6404 schtasks.exe 7692 schtasks.exe 5792 schtasks.exe 1216 schtasks.exe 8024 schtasks.exe 5436 schtasks.exe 6960 schtasks.exe 7004 schtasks.exe 5836 schtasks.exe 5548 schtasks.exe 7512 schtasks.exe 6496 schtasks.exe 868 schtasks.exe 5304 schtasks.exe 1044 schtasks.exe 7068 schtasks.exe 2972 schtasks.exe 5444 schtasks.exe 5320 schtasks.exe 5744 schtasks.exe 7428 schtasks.exe 5316 schtasks.exe 5200 schtasks.exe 6440 schtasks.exe 4508 schtasks.exe 5384 schtasks.exe 3336 schtasks.exe 5484 schtasks.exe 5524 schtasks.exe 6812 schtasks.exe 8040 schtasks.exe 7820 schtasks.exe 4716 schtasks.exe 2580 schtasks.exe 4584 schtasks.exe 7216 schtasks.exe 5468 schtasks.exe 6692 schtasks.exe 3164 schtasks.exe 2388 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5664 AnyLoaderV4.9.exe 5664 AnyLoaderV4.9.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4604 AnyLoaderV4.9.exe Token: SeDebugPrivilege 3936 AnyLoaderV4.9.exe Token: SeDebugPrivilege 2860 firefox.exe Token: SeDebugPrivilege 2860 firefox.exe Token: SeDebugPrivilege 4464 AnyLoaderV4.9.exe Token: SeDebugPrivilege 3644 AnyLoaderV4.9.exe Token: SeDebugPrivilege 4644 AnyLoaderV4.9.exe Token: SeDebugPrivilege 4644 AnyLoaderV4.9.exe Token: 33 1672 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1672 AUDIODG.EXE Token: SeDebugPrivilege 4892 AnyLoaderV4.9.exe Token: SeDebugPrivilege 2860 firefox.exe Token: SeDebugPrivilege 5316 AnyLoaderV4.9.exe Token: SeDebugPrivilege 5448 AnyLoaderV4.9.exe Token: SeDebugPrivilege 5732 AnyLoaderV4.9.exe Token: SeDebugPrivilege 5464 AnyLoaderV4.9.exe Token: SeDebugPrivilege 3936 AnyLoaderV4.9.exe Token: SeDebugPrivilege 5416 AnyLoaderV4.9.exe Token: SeDebugPrivilege 5664 AnyLoaderV4.9.exe Token: SeDebugPrivilege 3360 AnyLoaderV4.9.exe Token: SeDebugPrivilege 632 AnyLoaderV4.9.exe Token: SeDebugPrivilege 5800 AnyLoaderV4.9.exe Token: SeDebugPrivilege 5136 AnyLoaderV4.9.exe Token: SeDebugPrivilege 3460 AnyLoaderV4.9.exe Token: SeDebugPrivilege 2860 firefox.exe Token: SeDebugPrivilege 2860 firefox.exe Token: SeDebugPrivilege 2860 firefox.exe Token: SeDebugPrivilege 568 AnyLoaderV4.9.exe Token: SeDebugPrivilege 4440 AnyLoaderV4.9.exe Token: SeDebugPrivilege 5712 AnyLoaderV4.9.exe Token: SeDebugPrivilege 1320 AnyLoaderV4.9.exe Token: SeDebugPrivilege 3736 AnyLoaderV4.9.exe Token: SeDebugPrivilege 4964 AnyLoaderV4.9.exe Token: SeDebugPrivilege 5712 AnyLoaderV4.9.exe Token: SeDebugPrivilege 1928 AnyLoaderV4.9.exe Token: SeDebugPrivilege 1032 AnyLoaderV4.9.exe Token: SeDebugPrivilege 4972 AnyLoaderV4.9.exe Token: SeDebugPrivilege 2520 AnyLoaderV4.9.exe Token: SeDebugPrivilege 2476 AnyLoaderV4.9.exe Token: SeDebugPrivilege 2860 firefox.exe Token: SeDebugPrivilege 4656 AnyLoaderV4.9.exe Token: SeDebugPrivilege 3252 AnyLoaderV4.9.exe Token: SeDebugPrivilege 5616 AnyLoaderV4.9.exe Token: SeDebugPrivilege 7640 AnyLoaderV4.9.exe Token: SeDebugPrivilege 7880 AnyLoaderV4.9.exe Token: SeDebugPrivilege 5260 AnyLoaderV4.9.exe Token: SeDebugPrivilege 4588 AnyLoaderV4.9.exe Token: SeDebugPrivilege 2916 AnyLoaderV4.9.exe Token: SeDebugPrivilege 5936 AnyLoaderV4.9.exe Token: SeDebugPrivilege 6320 AnyLoaderV4.9.exe Token: SeDebugPrivilege 6576 AnyLoaderV4.9.exe Token: SeDebugPrivilege 6832 AnyLoaderV4.9.exe Token: SeDebugPrivilege 2860 firefox.exe Token: SeDebugPrivilege 7140 AnyLoaderV4.9.exe Token: SeDebugPrivilege 7376 AnyLoaderV4.9.exe Token: SeDebugPrivilege 7932 AnyLoaderV4.9.exe Token: SeDebugPrivilege 5512 AnyLoaderV4.9.exe Token: SeDebugPrivilege 8080 AnyLoaderV4.9.exe Token: SeDebugPrivilege 5500 AnyLoaderV4.9.exe Token: SeDebugPrivilege 5992 AnyLoaderV4.9.exe Token: SeDebugPrivilege 8104 AnyLoaderV4.9.exe Token: SeDebugPrivilege 6176 AnyLoaderV4.9.exe Token: SeDebugPrivilege 6336 AnyLoaderV4.9.exe Token: SeDebugPrivilege 6440 AnyLoaderV4.9.exe -
Suspicious use of FindShellTrayWindow 21 IoCs
pid Process 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe -
Suspicious use of SendNotifyMessage 20 IoCs
pid Process 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2860 firefox.exe 3936 AnyLoaderV4.9.exe 2860 firefox.exe 2860 firefox.exe 2860 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4604 wrote to memory of 2580 4604 AnyLoaderV4.9.exe 82 PID 4604 wrote to memory of 2580 4604 AnyLoaderV4.9.exe 82 PID 4604 wrote to memory of 3936 4604 AnyLoaderV4.9.exe 84 PID 4604 wrote to memory of 3936 4604 AnyLoaderV4.9.exe 84 PID 4204 wrote to memory of 2860 4204 firefox.exe 88 PID 4204 wrote to memory of 2860 4204 firefox.exe 88 PID 4204 wrote to memory of 2860 4204 firefox.exe 88 PID 4204 wrote to memory of 2860 4204 firefox.exe 88 PID 4204 wrote to memory of 2860 4204 firefox.exe 88 PID 4204 wrote to memory of 2860 4204 firefox.exe 88 PID 4204 wrote to memory of 2860 4204 firefox.exe 88 PID 4204 wrote to memory of 2860 4204 firefox.exe 88 PID 4204 wrote to memory of 2860 4204 firefox.exe 88 PID 4204 wrote to memory of 2860 4204 firefox.exe 88 PID 4204 wrote to memory of 2860 4204 firefox.exe 88 PID 3936 wrote to memory of 2972 3936 AnyLoaderV4.9.exe 89 PID 3936 wrote to memory of 2972 3936 AnyLoaderV4.9.exe 89 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 756 2860 firefox.exe 91 PID 2860 wrote to memory of 736 2860 firefox.exe 92 PID 2860 wrote to memory of 736 2860 firefox.exe 92 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ANYX-client-build\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Local\Temp\ANYX-client-build\AnyLoaderV4.9.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2580
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Cxf5ILpluRKh.bat" "3⤵PID:2096
-
C:\Windows\system32\chcp.comchcp 650014⤵PID:384
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3000
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4464 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
PID:4480
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uUGobO8WwRGx.bat" "5⤵PID:1972
-
C:\Windows\system32\chcp.comchcp 650016⤵PID:3668
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3100
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3644 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f7⤵PID:1128
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ijw3mQzgekmr.bat" "7⤵PID:3224
-
C:\Windows\system32\chcp.comchcp 650018⤵PID:4584
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3736
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4644 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f9⤵
- Scheduled Task/Job: Scheduled Task
PID:2388
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IpqLHyAcdjG6.bat" "9⤵PID:3652
-
C:\Windows\system32\chcp.comchcp 6500110⤵PID:4584
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost10⤵
- Runs ping.exe
PID:3420
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4644 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f11⤵
- Scheduled Task/Job: Scheduled Task
PID:4584
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\d0b6jrQnNjiG.bat" "11⤵PID:2200
-
C:\Windows\system32\chcp.comchcp 6500112⤵PID:4008
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4168
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4892 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f13⤵
- Scheduled Task/Job: Scheduled Task
PID:4508
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vk0lQEqMaxgO.bat" "13⤵PID:2172
-
C:\Windows\system32\chcp.comchcp 6500114⤵PID:2580
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost14⤵
- Runs ping.exe
PID:4180
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5732 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f15⤵
- Scheduled Task/Job: Scheduled Task
PID:5920
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PX1Y7Rt86zj4.bat" "15⤵PID:6064
-
C:\Windows\system32\chcp.comchcp 6500116⤵PID:6112
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:6128
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3936 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f17⤵
- Scheduled Task/Job: Scheduled Task
PID:5804
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fYL9ps6yVUHq.bat" "17⤵PID:6012
-
C:\Windows\system32\chcp.comchcp 6500118⤵PID:5928
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost18⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5748
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ba7f821-d97f-406f-9f48-f19ce02b4f0b} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" gpu3⤵PID:756
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2428 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec5b1545-a813-49df-ae54-38f4a441e3cc} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" socket3⤵PID:736
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3376 -childID 1 -isForBrowser -prefsHandle 3368 -prefMapHandle 3348 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6b46300-9c82-4911-a16a-90158065828f} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:3760
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3736 -childID 2 -isForBrowser -prefsHandle 3220 -prefMapHandle 3216 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fce7f16-b8ef-4f7a-965a-38ce963865ee} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:1184
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4272 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4356 -prefMapHandle 4352 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74ba9538-0fd7-4736-b146-059c960aadf2} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" utility3⤵
- Checks processor information in registry
PID:808
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5548 -childID 3 -isForBrowser -prefsHandle 5572 -prefMapHandle 5568 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6ec19ce-c2e6-4bfe-8832-bf4cd4fbcb31} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:972
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5744 -childID 4 -isForBrowser -prefsHandle 5748 -prefMapHandle 5572 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b4893b5-3fad-4b52-9fe6-43e7650db511} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:4668
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5804 -childID 5 -isForBrowser -prefsHandle 5812 -prefMapHandle 5816 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2959665-c37a-434f-9c2b-298c701ba000} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:3212
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5268 -childID 6 -isForBrowser -prefsHandle 2604 -prefMapHandle 3512 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44e284da-6349-4d3a-bd4d-6c5600450e9a} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:1944
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6276 -parentBuildID 20240401114208 -prefsHandle 6304 -prefMapHandle 6300 -prefsLen 30533 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e91f48cc-3518-4d43-8c8d-aae756b41015} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" rdd3⤵PID:3668
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6280 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6316 -prefMapHandle 6312 -prefsLen 30533 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5103db37-1085-4297-bf90-7e4e7b7e5c17} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" utility3⤵
- Checks processor information in registry
PID:5036
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6624 -childID 7 -isForBrowser -prefsHandle 6708 -prefMapHandle 6584 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44ed8f49-60fb-45ef-9e6f-031e1d127d00} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:868
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6620 -childID 8 -isForBrowser -prefsHandle 6632 -prefMapHandle 6616 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77444265-db73-4070-9fdc-616137335153} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:3212
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7232 -childID 9 -isForBrowser -prefsHandle 7188 -prefMapHandle 7204 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {924369d3-cd81-406e-ba5b-4b4e9bc6cf03} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:4892
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5948 -childID 10 -isForBrowser -prefsHandle 3728 -prefMapHandle 7340 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01666ea9-ea73-45c4-9f19-f7f6bcc05ac7} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:5220
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7572 -childID 11 -isForBrowser -prefsHandle 5956 -prefMapHandle 6600 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e0be1af-f02d-463a-8c2b-5598179ec958} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:5252
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6960 -childID 12 -isForBrowser -prefsHandle 6188 -prefMapHandle 5252 -prefsLen 28282 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d169cd01-28bb-4ef6-8d7b-864834b20756} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:6116
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6292 -childID 13 -isForBrowser -prefsHandle 7252 -prefMapHandle 7372 -prefsLen 28282 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77cd6877-b4f8-4e35-8385-9eb9fca96bf6} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:6076
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6180 -childID 14 -isForBrowser -prefsHandle 1908 -prefMapHandle 5060 -prefsLen 28282 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {150737d1-a261-4bcc-adbb-dd95f9dd68d8} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:3736
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7640 -childID 15 -isForBrowser -prefsHandle 7652 -prefMapHandle 7648 -prefsLen 28282 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c964f4a2-3f32-4388-b34b-73e063b2ef45} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:2980
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6176 -childID 16 -isForBrowser -prefsHandle 3464 -prefMapHandle 4464 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2465eef3-acda-49db-8c34-b97586e0b9da} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:6088
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7240 -childID 17 -isForBrowser -prefsHandle 6652 -prefMapHandle 7304 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {adb05475-0a2b-4056-8849-d9f0184a823a} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:5944
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5268 -childID 18 -isForBrowser -prefsHandle 6016 -prefMapHandle 7268 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c256fab2-e020-440e-b1ca-bedb3ef0dfcc} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:7660
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7456 -childID 19 -isForBrowser -prefsHandle 7656 -prefMapHandle 7808 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8954a637-e13d-4e3f-949b-75e58907a920} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:3224
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6792 -childID 20 -isForBrowser -prefsHandle 2636 -prefMapHandle 1700 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {559da977-5609-48c1-975e-5076b34cc4b9} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:6940
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1424 -childID 21 -isForBrowser -prefsHandle 8040 -prefMapHandle 8036 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {beffcdea-018d-40cc-86e8-24b1e23970e5} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:7768
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5136 -childID 22 -isForBrowser -prefsHandle 6744 -prefMapHandle 7860 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ecdecd3-8a24-4e12-84de-4a26fd8e434f} 2860 "\\.\pipe\gecko-crash-server-pipe.2860" tab3⤵PID:3728
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x494 0x48c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1672
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\8280f7ee-c011-4ed8-993f-c8543032f32d_ANYX-client-build.zip.32d\ANYX-client-build\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Local\Temp\8280f7ee-c011-4ed8-993f-c8543032f32d_ANYX-client-build.zip.32d\ANYX-client-build\AnyLoaderV4.9.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5316 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5384
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5448 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:5492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TBczWvC00Ty3.bat" "3⤵PID:5636
-
C:\Windows\system32\chcp.comchcp 650014⤵PID:5684
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5700
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5464 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f5⤵PID:5608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mhNNZOvsFBeM.bat" "5⤵PID:1864
-
C:\Windows\system32\chcp.comchcp 650016⤵PID:5848
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3736
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5416 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f7⤵
- Scheduled Task/Job: Scheduled Task
PID:5320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Nlem0jVMVCXQ.bat" "7⤵PID:5604
-
C:\Windows\system32\chcp.comchcp 650018⤵PID:5712
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5700
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:632 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f9⤵
- Scheduled Task/Job: Scheduled Task
PID:4032
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HzGU29rEkowh.bat" "9⤵PID:6064
-
C:\Windows\system32\chcp.comchcp 6500110⤵PID:5816
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost10⤵
- Runs ping.exe
PID:4656
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5800 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f11⤵
- Scheduled Task/Job: Scheduled Task
PID:5792
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\whQRq2ioK0A6.bat" "11⤵PID:6008
-
C:\Windows\system32\chcp.comchcp 6500112⤵PID:1708
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost12⤵
- Runs ping.exe
PID:8
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5136 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f13⤵
- Scheduled Task/Job: Scheduled Task
PID:5620
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uKUyKbkogo3h.bat" "13⤵PID:5852
-
C:\Windows\system32\chcp.comchcp 6500114⤵PID:4032
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost14⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:6084
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3460 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f15⤵
- Scheduled Task/Job: Scheduled Task
PID:2308
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BLQ6vcyBTWRy.bat" "15⤵PID:2560
-
C:\Windows\system32\chcp.comchcp 6500116⤵PID:6028
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5964
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:568 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f17⤵
- Scheduled Task/Job: Scheduled Task
PID:1216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GnHcTzxrSsiv.bat" "17⤵PID:5892
-
C:\Windows\system32\chcp.comchcp 6500118⤵PID:5764
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost18⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5320
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4440 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f19⤵PID:4740
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AwBHdWkNZQjj.bat" "19⤵PID:2312
-
C:\Windows\system32\chcp.comchcp 6500120⤵PID:5696
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost20⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:6140
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5712 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f21⤵
- Scheduled Task/Job: Scheduled Task
PID:868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nWFWQjDcpsZw.bat" "21⤵PID:2512
-
C:\Windows\system32\chcp.comchcp 6500122⤵PID:5880
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost22⤵
- Runs ping.exe
PID:2308
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1320 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f23⤵
- Scheduled Task/Job: Scheduled Task
PID:1800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VE2r9VKO4srn.bat" "23⤵PID:2012
-
C:\Windows\system32\chcp.comchcp 6500124⤵PID:5540
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost24⤵
- Runs ping.exe
PID:5320
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3736 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f25⤵PID:5500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kJBTrmypW0At.bat" "25⤵PID:5692
-
C:\Windows\system32\chcp.comchcp 6500126⤵PID:3748
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost26⤵
- Runs ping.exe
PID:4400
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4964 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f27⤵
- Scheduled Task/Job: Scheduled Task
PID:1992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\akdypytD3r7x.bat" "27⤵PID:5816
-
C:\Windows\system32\chcp.comchcp 6500128⤵PID:5824
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost28⤵
- Runs ping.exe
PID:5804
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5712 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f29⤵
- Scheduled Task/Job: Scheduled Task
PID:5444
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uL117wT2d0PH.bat" "29⤵PID:1724
-
C:\Windows\system32\chcp.comchcp 6500130⤵PID:5616
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost30⤵
- Runs ping.exe
PID:4916
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1928 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f31⤵
- Scheduled Task/Job: Scheduled Task
PID:5836
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EVSKaUraaAzw.bat" "31⤵PID:2308
-
C:\Windows\system32\chcp.comchcp 6500132⤵PID:5596
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost32⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:568
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1032 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f33⤵
- Scheduled Task/Job: Scheduled Task
PID:1044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\otfvhnpVa461.bat" "33⤵PID:2916
-
C:\Windows\system32\chcp.comchcp 6500134⤵PID:2200
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost34⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4280
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"34⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4972 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f35⤵
- Scheduled Task/Job: Scheduled Task
PID:5304
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FVWIPyXMW4kt.bat" "35⤵PID:3928
-
C:\Windows\system32\chcp.comchcp 6500136⤵PID:5404
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost36⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:840
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2520 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f37⤵PID:2808
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MZNMOP9LqQ18.bat" "37⤵PID:5292
-
C:\Windows\system32\chcp.comchcp 6500138⤵PID:2564
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost38⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:800
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"38⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2476 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f39⤵
- Scheduled Task/Job: Scheduled Task
PID:5272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7htta8qJUbm0.bat" "39⤵PID:3876
-
C:\Windows\system32\chcp.comchcp 6500140⤵PID:5500
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost40⤵
- Runs ping.exe
PID:4440
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4656 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f41⤵PID:4244
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TLJWqKZC6bJv.bat" "41⤵PID:4624
-
C:\Windows\system32\chcp.comchcp 6500142⤵PID:328
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost42⤵
- Runs ping.exe
PID:5308
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3252 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f43⤵PID:1612
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2K62F5QST03W.bat" "43⤵PID:5688
-
C:\Windows\system32\chcp.comchcp 6500144⤵PID:2960
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost44⤵
- Runs ping.exe
PID:5740
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5616 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f45⤵
- Scheduled Task/Job: Scheduled Task
PID:5484
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6QbqKm1A5PIJ.bat" "45⤵PID:5520
-
C:\Windows\system32\chcp.comchcp 6500146⤵PID:1092
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost46⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5888
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:7640 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f47⤵
- Scheduled Task/Job: Scheduled Task
PID:7668
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WLyBvVqaakQJ.bat" "47⤵PID:7780
-
C:\Windows\system32\chcp.comchcp 6500148⤵PID:7828
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost48⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:7844
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"48⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:7880 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f49⤵
- Scheduled Task/Job: Scheduled Task
PID:7904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ckXQO3A6XtLH.bat" "49⤵PID:8012
-
C:\Windows\system32\chcp.comchcp 6500150⤵PID:8056
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost50⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:8072
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5260 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f51⤵PID:1048
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wPCSEfg9GT3z.bat" "51⤵PID:5300
-
C:\Windows\system32\chcp.comchcp 6500152⤵PID:3628
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost52⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:4016
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"52⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4588 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f53⤵PID:3356
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\L9R5joS3N3Cr.bat" "53⤵PID:5920
-
C:\Windows\system32\chcp.comchcp 6500154⤵PID:1220
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost54⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:4916
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2916 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f55⤵
- Scheduled Task/Job: Scheduled Task
PID:5744
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Dhr0kWrL1inZ.bat" "55⤵PID:2288
-
C:\Windows\system32\chcp.comchcp 6500156⤵PID:1688
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost56⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:4168
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"56⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5936 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f57⤵
- Scheduled Task/Job: Scheduled Task
PID:5524
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5ilEjsdpa4yr.bat" "57⤵PID:2548
-
C:\Windows\system32\chcp.comchcp 6500158⤵PID:4924
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost58⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:732
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"58⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6320 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f59⤵PID:6396
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kEzu5wJ8eRzy.bat" "59⤵PID:6432
-
C:\Windows\system32\chcp.comchcp 6500160⤵PID:6472
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost60⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:6488
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"60⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6576 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f61⤵PID:6612
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RX4P3EkOUtCG.bat" "61⤵PID:6720
-
C:\Windows\system32\chcp.comchcp 6500162⤵PID:6768
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost62⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:6780
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"62⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6832 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f63⤵
- Scheduled Task/Job: Scheduled Task
PID:6812
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WQyXGs7zSx07.bat" "63⤵PID:6972
-
C:\Windows\system32\chcp.comchcp 6500164⤵PID:7080
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost64⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:7096
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"64⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:7140 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f65⤵
- Scheduled Task/Job: Scheduled Task
PID:7068
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oTvI0H7nUMqk.bat" "65⤵PID:6844
-
C:\Windows\system32\chcp.comchcp 6500166⤵PID:6992
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost66⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:7300
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"66⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:7376 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f67⤵
- Scheduled Task/Job: Scheduled Task
PID:7428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TLUa3uRyMDuc.bat" "67⤵PID:7436
-
C:\Windows\system32\chcp.comchcp 6500168⤵PID:7556
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost68⤵PID:7580
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"68⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:7932 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f69⤵PID:7908
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\i5w6DTrTLpD4.bat" "69⤵PID:8004
-
C:\Windows\system32\chcp.comchcp 6500170⤵PID:5988
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost70⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:5756
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"70⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5512 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f71⤵PID:3768
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\duHdqp8OKqCc.bat" "71⤵PID:5552
-
C:\Windows\system32\chcp.comchcp 6500172⤵PID:6016
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost72⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2312
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"72⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:8080 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f73⤵PID:8032
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HKpSrkyIwiA7.bat" "73⤵PID:5312
-
C:\Windows\system32\chcp.comchcp 6500174⤵PID:2628
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost74⤵
- Runs ping.exe
PID:3628
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"74⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5500 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f75⤵
- Scheduled Task/Job: Scheduled Task
PID:5724
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LtkATMvls4c6.bat" "75⤵PID:5440
-
C:\Windows\system32\chcp.comchcp 6500176⤵PID:5432
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost76⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5896
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"76⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5992 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f77⤵PID:2024
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\R1ECwvJZFxVK.bat" "77⤵PID:4788
-
C:\Windows\system32\chcp.comchcp 6500178⤵PID:2552
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost78⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4764
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"78⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:8104 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f79⤵
- Scheduled Task/Job: Scheduled Task
PID:5548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5YeDUr5x0cfN.bat" "79⤵PID:8152
-
C:\Windows\system32\chcp.comchcp 6500180⤵PID:5656
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost80⤵
- Runs ping.exe
PID:1600
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"80⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6176 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f81⤵PID:1092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lVNaq43yYcPS.bat" "81⤵PID:6364
-
C:\Windows\system32\chcp.comchcp 6500182⤵PID:6324
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost82⤵PID:6332
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"82⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6336 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f83⤵PID:6484
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VxMag1WwLjZb.bat" "83⤵PID:1448
-
C:\Windows\system32\chcp.comchcp 6500184⤵PID:7524
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost84⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:6508
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"84⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6440 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f85⤵PID:6652
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\m76sKVrdaDxH.bat" "85⤵PID:6576
-
C:\Windows\system32\chcp.comchcp 6500186⤵PID:5976
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1672
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"86⤵
- Executes dropped EXE
PID:1516 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f87⤵
- Scheduled Task/Job: Scheduled Task
PID:6180
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kBrKxZqjBrDd.bat" "87⤵PID:7116
-
C:\Windows\system32\chcp.comchcp 6500188⤵PID:6988
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost88⤵
- Runs ping.exe
PID:7056
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"88⤵
- Checks computer location settings
- Executes dropped EXE
PID:7300 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f89⤵
- Scheduled Task/Job: Scheduled Task
PID:6844
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uNDui1mWnOp8.bat" "89⤵PID:7352
-
C:\Windows\system32\chcp.comchcp 6500190⤵PID:7572
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost90⤵
- Runs ping.exe
PID:7636
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"90⤵
- Checks computer location settings
- Executes dropped EXE
PID:5900 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f91⤵
- Scheduled Task/Job: Scheduled Task
PID:5316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lfPwF216G61H.bat" "91⤵PID:5856
-
C:\Windows\system32\chcp.comchcp 6500192⤵PID:7704
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost92⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:7708
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"92⤵
- Executes dropped EXE
PID:3948 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f93⤵PID:7768
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\w5CxD5vPBc0F.bat" "93⤵PID:7784
-
C:\Windows\system32\chcp.comchcp 6500194⤵PID:1612
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost94⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:7592
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"94⤵
- Executes dropped EXE
PID:7492 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f95⤵
- Scheduled Task/Job: Scheduled Task
PID:7512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LC5Aj0cptpyP.bat" "95⤵PID:7880
-
C:\Windows\system32\chcp.comchcp 6500196⤵PID:6020
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost96⤵PID:5692
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"96⤵
- Checks computer location settings
- Executes dropped EXE
PID:6100 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f97⤵PID:5464
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3pfw1cZ6AJfg.bat" "97⤵PID:8144
-
C:\Windows\system32\chcp.comchcp 6500198⤵PID:8108
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost98⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:896
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"98⤵
- Checks computer location settings
- Executes dropped EXE
PID:2796 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f99⤵
- Scheduled Task/Job: Scheduled Task
PID:2292
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Sft44Q1P00fd.bat" "99⤵PID:2896
-
C:\Windows\system32\chcp.comchcp 65001100⤵PID:3728
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost100⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:4648
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"100⤵
- Checks computer location settings
- Executes dropped EXE
PID:5088 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f101⤵
- Scheduled Task/Job: Scheduled Task
PID:5436
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iQK1LzCKaZqp.bat" "101⤵PID:3164
-
C:\Windows\system32\chcp.comchcp 65001102⤵PID:4896
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost102⤵
- Runs ping.exe
PID:4688
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"102⤵
- Checks computer location settings
- Executes dropped EXE
PID:2004 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f103⤵
- Scheduled Task/Job: Scheduled Task
PID:5320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5mbgP7jhYWWw.bat" "103⤵PID:4068
-
C:\Windows\system32\chcp.comchcp 65001104⤵PID:5392
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost104⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:1468
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"104⤵
- Checks computer location settings
- Executes dropped EXE
PID:5896 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f105⤵
- Scheduled Task/Job: Scheduled Task
PID:5440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\G4PFLywjwuaB.bat" "105⤵PID:4584
-
C:\Windows\system32\chcp.comchcp 65001106⤵PID:5992
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost106⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:1032
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"106⤵
- Checks computer location settings
- Executes dropped EXE
PID:6112 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f107⤵PID:3620
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RANIn122EBCz.bat" "107⤵PID:5164
-
C:\Windows\system32\chcp.comchcp 65001108⤵PID:5072
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost108⤵
- Runs ping.exe
PID:1152
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"108⤵
- Checks computer location settings
- Executes dropped EXE
PID:4328 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f109⤵
- Scheduled Task/Job: Scheduled Task
PID:5200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WjIQQH1Qi2WP.bat" "109⤵PID:4788
-
C:\Windows\system32\chcp.comchcp 65001110⤵PID:4508
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost110⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5068
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"110⤵
- Checks computer location settings
- Executes dropped EXE
PID:5792 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f111⤵PID:840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bMg6k4QzemBx.bat" "111⤵PID:8160
-
C:\Windows\system32\chcp.comchcp 65001112⤵PID:880
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost112⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:6152
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"112⤵
- Checks computer location settings
PID:5904 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f113⤵PID:636
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SvUciPHjBiFo.bat" "113⤵PID:6364
-
C:\Windows\system32\chcp.comchcp 65001114⤵PID:6536
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost114⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:6484
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"114⤵PID:6312
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f115⤵
- Scheduled Task/Job: Scheduled Task
PID:3280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GSu6Mxc40HcN.bat" "115⤵PID:2136
-
C:\Windows\system32\chcp.comchcp 65001116⤵PID:6708
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost116⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:6692
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"116⤵
- Checks computer location settings
PID:6616 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f117⤵
- Scheduled Task/Job: Scheduled Task
PID:6440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yHqhfYoC9eV5.bat" "117⤵PID:4200
-
C:\Windows\system32\chcp.comchcp 65001118⤵PID:2540
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost118⤵
- Runs ping.exe
PID:568
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"118⤵
- Checks computer location settings
PID:6812 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f119⤵
- Scheduled Task/Job: Scheduled Task
PID:6960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XlcDzf9erpGR.bat" "119⤵PID:6576
-
C:\Windows\system32\chcp.comchcp 65001120⤵PID:7112
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost120⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:7100
-
-
C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe"120⤵PID:6560
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\AnyLoaderV4.9.exe" /rl HIGHEST /f121⤵PID:7068
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OrtAO3s4V77H.bat" "121⤵PID:7604
-
C:\Windows\system32\chcp.comchcp 65001122⤵PID:7324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-