Resubmissions
15/09/2026, 11:12
260915-navswatygv1007/09/2026, 00:25
260907-aqql7sttav1004/08/2026, 14:58
260804-sb5rpashpf1004/08/2026, 06:06
260804-gt3t9seb381004/08/2026, 05:43
260804-gey8jaw1bx1024/07/2026, 07:14
260724-h2zy1svbmg1024/07/2026, 07:09
260724-hy9ztatwfy1024/07/2026, 06:50
260724-hmdggahn6v1021/07/2026, 16:13
260721-tpe9macc42321/07/2026, 16:00
260721-tfvb7axvcy10Analysis
- max time kernel
675s - max time network
676s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
10/11/2025, 00:23
General
- Target New Text Document mod.exe
- Size 8KB
- Sample251110-apl8dswkgl
- SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
Malware Config
Extracted
-
metasploit
-
metasploit_stager
-
176.122.27.90:8888
Extracted
-
vidar
-
16.5
-
153b1897854fdeb399aeb8c5b1e5efba
-
https://steamcommunity.com/profiles/76561198772659493
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0
Extracted
-
quasar
-
encryption_key
DD927C95B4E9EA3466E4C75C79D5817877BF6EAC
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Extracted
-
xworm
-
172.245.27.131:6000
-
Install_directory
%AppData%
-
install_file
x.exe
Extracted
-
xworm
-
XWorm V6.5 by c3lestial.fun
-
172.245.27.131:6000
-
7yQ13dQovyNKiXuS
-
install_file
USB.exe
Extracted
-
xenorat
-
172.245.27.131
-
Xeno_rat_nd8912d
-
delay
5000
-
install_path
nothingset
-
port
6000
-
startup_name
nothingset
Extracted
-
quasar
-
1.3.0.0
-
Office04
-
213.142.159.116:1604
-
QSR_MUTEX_ywpdDTYeaTEYtNJojX
-
encryption_key
qMha1sv2dyaj4Dbgljva
-
install_name
syss.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Client
-
subdirectory
SubDir
Extracted
-
stealc
-
tr1pernn
-
http://178.16.54.175
-
url_path
/fc98bed393364b52.php
Signatures
- Detect XenoRat Payload 3 IoCs
- Detect Xworm Payload 4 IoCs
- Detects MeshAgent payload 1 IoCs
- Detects Sheetrat obfuscated V2.0 and higher 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Vidar Stealer 3 IoCs
- MeshAgent
MeshAgent is an open source remote access trojan written in C++.
- Meshagent family
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Metasploit family
- Phorphiex family
- Phorphiex payload 1 IoCs
- Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 5 IoCs
- Sheetrat family
- Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar family
- XenorRat
XenorRat is a remote access trojan written in C#.
- Xenorat family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 15 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Possible privilege escalation attempt 2 IoCs
- Sets service image path in registry 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Creates new service(s) 2 TTPs
- Disables service(s) 3 TTPs
- Executes dropped EXE 32 IoCs
- Loads dropped DLL 5 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Stops running service(s) 4 TTPs
- Themida packer 4 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 13 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 64 IoCs
- Enumerates processes with tasklist 1 TTPs 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- UPX packed file 55 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 9 IoCs
- Launches sc.exe 26 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Detects Pyinstaller 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 5 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Delays execution with timeout.exe 2 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 5 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 33 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\cooking.exe"C:\Users\Admin\AppData\Local\Temp\a\cooking.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\attrib.exeattrib.exe3⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd /c move Pet.wms Pet.wms.bat && Pet.wms.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr "bdservicehost ekrn AvastUI SophosHealth AVGUI nsWscSvc"4⤵
-
-
C:\Windows\system32\extrac32.exeextrac32 /Y Bangbus.wms *.*4⤵
-
-
C:\Windows\system32\findstr.exefindstr /V "Led" Remembered4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\651926\Enclosure.scrEnclosure.scr H4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\651926\Enclosure.scrC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\651926\Enclosure.scr5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\waitfor.exewaitfor /T 5 PZkRSmsFARKnQXCyMRpQCTdY4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\TLauncher-Installer-1.9.4.exe"C:\Users\Admin\AppData\Local\Temp\a\TLauncher-Installer-1.9.4.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3969818 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\a\TLauncher-Installer-1.9.4.exe" "__IRCT:3" "__IRTSS:26673688" "__IRSID:S-1-5-21-1372747213-2971725360-2986618536-1000"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\lJ5IwxN.exe"C:\Users\Admin\AppData\Local\Temp\a\lJ5IwxN.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\elf.exe"C:\Users\Admin\AppData\Local\Temp\a\elf.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\sys.exe"C:\Users\Admin\AppData\Local\Temp\a\sys.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\sup.exe"C:\Users\Admin\AppData\Local\Temp\a\sup.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\tmp.exe"C:\Users\Admin\AppData\Local\Temp\a\tmp.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\crypted_guardfile.exe"C:\Users\Admin\AppData\Local\Temp\a\crypted_guardfile.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7FC5.tmp"C:\Users\Admin\AppData\Local\Temp\tmp7FC5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exe"C:\Users\Admin\AppData\Local\Temp\a\random.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\rabert.exe"C:\Users\Admin\AppData\Local\Temp\a\rabert.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\rabert.exe"C:\Users\Admin\AppData\Local\Temp\a\rabert.exe" -fullinstall3⤵
- Sets service image path in registry
- Executes dropped EXE
- Drops file in Program Files directory
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\server.exe"C:\Users\Admin\AppData\Local\Temp\a\server.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\xmr.exe"C:\Users\Admin\AppData\Local\Temp\a\xmr.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "winmgr"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "winmgr" binpath= "C:\ProgramData\winmgr\syswinprdrvc.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "winmgr"3⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\GL0ygTD.exe"C:\Users\Admin\AppData\Local\Temp\a\GL0ygTD.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-Q3VEI.tmp\GL0ygTD.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q3VEI.tmp\GL0ygTD.tmp" /SL5="$55030C,4025341,56832,C:\Users\Admin\AppData\Local\Temp\a\GL0ygTD.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Multi-functional backup 3.3.8.4294\multifunctionalbackup294.exe"C:\Users\Admin\AppData\Local\Multi-functional backup 3.3.8.4294\multifunctionalbackup294.exe" -i4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\8RsL970.exe"C:\Users\Admin\AppData\Local\Temp\a\8RsL970.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SYSTEM32\change.exechange3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /c %comspec% < Christ.bin3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe4⤵
-
C:\Windows\system32\findstr.exefindstr /V "BUSINESSES" Complimentary5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\822148\Trails.scrTrails.scr S5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\822148\Trails.scrC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\822148\Trails.scr6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\06bK6nU.exe"C:\Users\Admin\AppData\Local\Temp\a\06bK6nU.exe"2⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xsmxmrpd.cha"3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\xsmxmrpd.cha /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\xsmxmrpd.cha\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\xsmxmrpd.cha --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc523bdcf8,0x7ffc523bdd04,0x7ffc523bdd104⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xsmxmrpd.cha" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2180,i,4186289717802552988,474095888794642508,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xsmxmrpd.cha" --field-trial-handle=2264,i,4186289717802552988,474095888794642508,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:114⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xsmxmrpd.cha" --field-trial-handle=2356,i,4186289717802552988,474095888794642508,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:134⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xsmxmrpd.cha" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2956,i,4186289717802552988,474095888794642508,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xsmxmrpd.cha" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2964,i,4186289717802552988,474095888794642508,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xsmxmrpd.cha" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3544,i,4186289717802552988,474095888794642508,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xsmxmrpd.cha" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3560,i,4186289717802552988,474095888794642508,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:94⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xsmxmrpd.cha" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3580,i,4186289717802552988,474095888794642508,262144 --variations-seed-version --mojo-platform-channel-handle=1624 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xsmxmrpd.cha" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3596,i,4186289717802552988,474095888794642508,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:94⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xsmxmrpd.cha" --field-trial-handle=4524,i,4186289717802552988,474095888794642508,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xsmxmrpd.cha" --field-trial-handle=5136,i,4186289717802552988,474095888794642508,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xsmxmrpd.cha" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5144,i,4186289717802552988,474095888794642508,262144 --variations-seed-version --mojo-platform-channel-handle=652 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xsmxmrpd.cha" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5216,i,4186289717802552988,474095888794642508,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\dva.exe"C:\Users\Admin\AppData\Local\Temp\a\dva.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Local\chrome_inject.exe"C:\Users\Admin\AppData\Local\Local\chrome_inject.exe" --verbose --fingerprint -o "C:\Users\Admin\AppData\Local\Local\Cookies" all3⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Local\chrome_inject.exe"C:\Users\Admin\AppData\Local\Local\chrome_inject.exe" --verbose --fingerprint -o "C:\Users\Admin\AppData\Local\Local\Cookies" all3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Local\info.dll",RunLocalInfoCreator3⤵
-
-
C:\Windows\SYSTEM32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Local\software.dll",RunSoftwareTask3⤵
-
-
C:\Windows\SYSTEM32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Local\processes.dll",RunProcessesTask3⤵
-
-
C:\Windows\SYSTEM32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Local\screenshot.dll",RunScreenshotTask3⤵
-
-
C:\Windows\SYSTEM32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Local\password_formatter.dll",RunPasswordFormatterTask3⤵
-
-
C:\Windows\SYSTEM32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Local\telegram_data_mover.dll",RunTelegramDataMover3⤵
-
-
C:\Users\Admin\AppData\Local\Local\additional_tool.exe"C:\Users\Admin\AppData\Local\Local\additional_tool.exe"3⤵
-
C:\Users\Admin\AppData\Local\Local\additional_tool.exe"C:\Users\Admin\AppData\Local\Local\additional_tool.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Local\another_tool.exe"C:\Users\Admin\AppData\Local\Local\another_tool.exe"3⤵
-
C:\Users\Admin\AppData\Local\Local\another_tool.exe"C:\Users\Admin\AppData\Local\Local\another_tool.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Local\extra_tool.exe"C:\Users\Admin\AppData\Local\Local\extra_tool.exe"3⤵
-
C:\Users\Admin\AppData\Local\Local\extra_tool.exe"C:\Users\Admin\AppData\Local\Local\extra_tool.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\x.exe"C:\Users\Admin\AppData\Local\Temp\a\x.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\xtest.exe"C:\Users\Admin\AppData\Local\Temp\a\xtest.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\xeno.exe"C:\Users\Admin\AppData\Local\Temp\a\xeno.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe"2⤵
-
C:\Windows\SysWOW64\SubDir\syss.exe"C:\Windows\SysWOW64\SubDir\syss.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\MSTeams.exe"C:\Users\Admin\AppData\Local\Temp\a\MSTeams.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\HCBSXXl.exe"C:\Users\Admin\AppData\Local\Temp\a\HCBSXXl.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\KI6Doqb.exe"C:\Users\Admin\AppData\Local\Temp\a\KI6Doqb.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\C8c1bbe.exe"C:\Users\Admin\AppData\Local\Temp\a\C8c1bbe.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-O6DK5.tmp\C8c1bbe.tmp"C:\Users\Admin\AppData\Local\Temp\is-O6DK5.tmp\C8c1bbe.tmp" /SL5="$602E4,5629294,882176,C:\Users\Admin\AppData\Local\Temp\a\C8c1bbe.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-BQC1M.tmp\TransmitteD.exe"C:\Users\Admin\AppData\Local\Temp\is-BQC1M.tmp\TransmitteD.exe"4⤵
-
C:\ProgramData\demohost_std\TransmitteD.exeC:\ProgramData\demohost_std\TransmitteD.exe5⤵
-
C:\Users\Admin\AppData\Local\ElevateMoni.exeC:\Users\Admin\AppData\Local\ElevateMoni.exe6⤵
-
-
C:\Users\Admin\AppData\Roaming\demohost_std\XPFix.exe"C:\Users\Admin\AppData\Roaming\demohost_std\XPFix.exe" "C:\Users\Admin\AppData\Roaming\demohost_std\XPFix.exe" /u6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\FgpTMxd.exe"C:\Users\Admin\AppData\Local\Temp\a\FgpTMxd.exe"2⤵
-
C:\Windows\system32\getmac.exe"getmac" /fo csv /nh3⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" diskdrive get serialnumber /format:csv3⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" csproduct get uuid /format:csv3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\1yb0enm.exe"C:\Users\Admin\AppData\Local\Temp\a\1yb0enm.exe"2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Users\Admin\Documents\NgMk2V5brhhz.exe"C:\Users\Admin\Documents\NgMk2V5brhhz.exe"3⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C net session4⤵
-
C:\Windows\system32\net.exenet session5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session6⤵
-
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c timeout /t 5 /nobreak >nul & del /F /Q "C:\Users\Admin\Documents\NgMk2V5brhhz.exe"4⤵
-
C:\Windows\system32\timeout.exetimeout /t 5 /nobreak5⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\Documents\vKf54Az15y7a.exe"C:\Users\Admin\Documents\vKf54Az15y7a.exe"3⤵
-
C:\Windows\system32\cmd.execmd.exe /C schtasks /query /tn MicrosoftEdgeUpdateTaskMachineUPAS4⤵
-
C:\Windows\system32\schtasks.exeschtasks /query /tn MicrosoftEdgeUpdateTaskMachineUPAS5⤵
-
-
-
C:\Windows\system32\cmd.execmd.exe /C C:\Users\Admin\AppData\Local\Temp\taskmanager.bat4⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 55⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\1yb0enm.exe3⤵
-
C:\Windows\system32\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\fz0oKy4.exe"C:\Users\Admin\AppData\Local\Temp\a\fz0oKy4.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\fzCgCtE.exe"C:\Users\Admin\AppData\Local\Temp\a\fzCgCtE.exe"2⤵
-
C:\Windows\SYSTEM32\sc.exesc.exe3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.execmd /c move Kai.dot Kai.dot.bat && Kai.dot.bat3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\findstr.exefindstr "bdservicehost ekrn AvastUI SophosHealth AVGUI nsWscSvc"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\0rXld4E.exe"C:\Users\Admin\AppData\Local\Temp\a\0rXld4E.exe"2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c move Mini.docm Mini.docm.bat && Mini.docm.bat3⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr "bdservicehost ekrn AvastUI SophosHealth AVGUI nsWscSvc"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\syschnu.exe"C:\Users\Admin\AppData\Local\Temp\a\syschnu.exe"2⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c netsh advfirewall set allprofiles state off3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableSmartScreen /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableSmartScreen /t REG_DWORD /d 0 /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\GHQHUGPA.exe"C:\Users\Admin\AppData\Local\Temp\GHQHUGPA.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HYSJMOSQ.exe"C:\Users\Admin\AppData\Local\Temp\HYSJMOSQ.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ZAjTMWu.exe"C:\Users\Admin\AppData\Local\Temp\a\ZAjTMWu.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ldplayer9_ld_407586_ld.exe"C:\Users\Admin\AppData\Local\Temp\a\ldplayer9_ld_407586_ld.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ClipAid-Pro.exe"C:\Users\Admin\AppData\Local\Temp\a\ClipAid-Pro.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\xobi.exe"C:\Users\Admin\AppData\Local\Temp\a\xobi.exe"2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\eIKUOTy44azX.exe"C:\Users\Admin\AppData\Local\eIKUOTy44azX.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Software.exe"C:\Users\Admin\AppData\Local\Temp\a\Software.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WalletConnectdevRestore.exe"C:\Users\Admin\AppData\Local\Temp\a\WalletConnectdevRestore.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\dPzCoRY.exe"C:\Users\Admin\AppData\Local\Temp\a\dPzCoRY.exe"2⤵
-
C:\Windows\SYSTEM32\convert.execonvert.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /c move Muscles.ppam Muscles.ppam.bat && Muscles.ppam.bat3⤵
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\findstr.exefindstr "bdservicehost ekrn AvastUI SophosHealth AVGUI nsWscSvc"4⤵
-
-
C:\Windows\system32\findstr.exefindstr /V "authorities" Scenes4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\svchron.exe"C:\Users\Admin\AppData\Local\Temp\a\svchron.exe"2⤵
-
C:\PROGRAM FILES\MOZILLA FIREFOX\firefox.exe"C:\PROGRAM FILES\MOZILLA FIREFOX\firefox.exe"3⤵
-
-
C:\ProgramData\update.exe"C:\ProgramData\update.exe"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\crypted_210314.bat" "3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -nop -w h -c "Start-Process cmd.exe -ArgumentList '/c \"C:\ProgramData\crypted_210314.bat\"' -WindowStyle Hidden"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\ProgramData\crypted_210314.bat"5⤵
-
-
-
-
C:\Program Files\Mozilla Firefox\Microsoft.Photos.exe"C:\Program Files\Mozilla Firefox\Microsoft.Photos.exe"3⤵
-
-
C:\Program Files\Windows Media Player\GetHelp.exe"C:\Program Files\Windows Media Player\GetHelp.exe"3⤵
-
-
C:\Program Files\Mozilla Firefox\AppInstallerElevatedAppServiceClient.exe"C:\Program Files\Mozilla Firefox\AppInstallerElevatedAppServiceClient.exe"3⤵
-
-
C:\PROGRAM FILES\MOZILLA FIREFOX\firefox.exe"C:\PROGRAM FILES\MOZILLA FIREFOX\firefox.exe"3⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\2O7gWSz.exe"C:\Users\Admin\AppData\Local\Temp\a\2O7gWSz.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\vnc.exe"C:\Users\Admin\AppData\Local\Temp\a\vnc.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\rh_0.9.3.exe"C:\Users\Admin\AppData\Local\Temp\a\rh_0.9.3.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\dfdsvc.exe"C:\Users\Admin\AppData\Local\Temp\a\dfdsvc.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Stealc.exe"C:\Users\Admin\AppData\Local\Temp\a\Stealc.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\xiobv.exe"C:\Users\Admin\AppData\Local\Temp\a\xiobv.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\10.exe"C:\Users\Admin\AppData\Local\Temp\a\10.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\v.exe"C:\Users\Admin\AppData\Local\Temp\a\v.exe"2⤵
-
C:\Users\Admin\winsvcn.exeC:\Users\Admin\winsvcn.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\newtpp.exe"C:\Users\Admin\AppData\Local\Temp\a\newtpp.exe"2⤵
-
C:\Windows\syscnrhost.exeC:\Windows\syscnrhost.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\32.exe"C:\Users\Admin\AppData\Local\Temp\a\32.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\472433034.exeC:\Users\Admin\AppData\Local\Temp\472433034.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\zocp.exe"C:\Users\Admin\AppData\Local\Temp\a\zocp.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1BOi0tXTJJWgZS1BzlecvJPgUWQPYe3K.exe"C:\Users\Admin\AppData\Local\Temp\a\1BOi0tXTJJWgZS1BzlecvJPgUWQPYe3K.exe"2⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C net session3⤵
-
C:\Windows\system32\net.exenet session4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command Add-MpPreference -ExclusionPath 'C:\Users\'; Add-MpPreference -ExclusionPath 'C:\ProgramData\'; Add-MpPreference -ExclusionPath 'C:\Windows\'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\sc.exesc.exe stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc.exe stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc.exe stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc.exe stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc.exe stop eventlog3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc.exe config wuauserv start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc.exe config UsoSvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc.exe config bits start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc.exe config dosvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc.exe config WaaSMedicSvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc.exe config eventlog start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C rmdir /S /Q "C:\\inetpub"3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "reagentc.exe /disable && takeown /f "C:\Windows\System32\reagentc.exe" && icacls "C:\Windows\System32\reagentc.exe" /grant administrators:F && del /f /q "C:\Windows\System32\reagentc.exe"3⤵
-
C:\Windows\system32\ReAgentc.exereagentc.exe /disable4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\reagentc.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\reagentc.exe" /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\8GVk01wwWXHHto7BJ1pwBajM8YOnUuQf.exe"C:\Users\Admin\AppData\Local\Temp\a\8GVk01wwWXHHto7BJ1pwBajM8YOnUuQf.exe"2⤵
-
C:\Windows\system32\cmd.execmd.exe /C schtasks /query /tn MicrosoftEdgeUpdateTaskMachineUPAS3⤵
-
C:\Windows\system32\schtasks.exeschtasks /query /tn MicrosoftEdgeUpdateTaskMachineUPAS4⤵
-
-
-
C:\Windows\system32\cmd.execmd.exe /c schtasks /create /sc minute /mo 1 /tn MicrosoftEdgeUpdateTaskMachineUPAS /tr C:\Users\Admin\AppData\Roaming\WindowsSystemDiagnostics.{D20EA4E1-3957-11D2-A40B-0C5020524153}\spooIsv.exe /f3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 1 /tn MicrosoftEdgeUpdateTaskMachineUPAS /tr C:\Users\Admin\AppData\Roaming\WindowsSystemDiagnostics.{D20EA4E1-3957-11D2-A40B-0C5020524153}\spooIsv.exe /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.execmd.exe /C C:\Users\Admin\AppData\Local\Temp\taskmanager.bat3⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 54⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Clipper.exe"C:\Users\Admin\AppData\Local\Temp\a\Clipper.exe"2⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Google Updater Task"3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Google Updater Task" /tr "C:\Users\Admin\AppData\Roaming\yidmyj.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\nonrendition.exe"C:\Users\Admin\AppData\Local\Temp\a\nonrendition.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\yyy.exe"C:\Users\Admin\AppData\Local\Temp\a\yyy.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\pitchometer.exe"C:\Users\Admin\AppData\Local\Temp\a\pitchometer.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\dropper64.exe"C:\Users\Admin\AppData\Local\Temp\a\dropper64.exe"2⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "63d344b1-6ff6-4b8c-806a-78935520fe16c"3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "63d344b1-6ff6-4b8c-806a-78935520fe16c" /tr "C:\ProgramData\dbffbcafec.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\extra_tool.exe"C:\Users\Admin\AppData\Local\Temp\a\extra_tool.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\extra_tool.exe"C:\Users\Admin\AppData\Local\Temp\a\extra_tool.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\additional_tool.exe"C:\Users\Admin\AppData\Local\Temp\a\additional_tool.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\additional_tool.exe"C:\Users\Admin\AppData\Local\Temp\a\additional_tool.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\another_tool.exe"C:\Users\Admin\AppData\Local\Temp\a\another_tool.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\another_tool.exe"C:\Users\Admin\AppData\Local\Temp\a\another_tool.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\chrome_inject.exe"C:\Users\Admin\AppData\Local\Temp\a\chrome_inject.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\crypted.exe"C:\Users\Admin\AppData\Local\Temp\a\crypted.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\crypted.exe"C:\Users\Admin\AppData\Local\Temp\a\crypted.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Minere.exe"C:\Users\Admin\AppData\Local\Temp\a\Minere.exe"2⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "Google"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "Google" binpath= "C:\ProgramData\Chrome\chrome_updater.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "Google"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\a\Minere.exe"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\x64-setup.exe"C:\Users\Admin\AppData\Local\Temp\a\x64-setup.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Injector.exe"C:\Users\Admin\AppData\Local\Temp\a\Injector.exe"2⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Updater Task"3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows Updater Task" /tr "C:\ProgramData\systemdrv.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\NOTEPAD.exe"C:\Users\Admin\AppData\Local\Temp\a\NOTEPAD.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\NOTEPAD.exe"C:\Users\Admin\AppData\Local\Temp\a\NOTEPAD.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\POWERPOINT.exe"C:\Users\Admin\AppData\Local\Temp\a\POWERPOINT.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "USD" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\USD.exe"3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 74⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "USD" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\USD.exe"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 15 > nul && copy "C:\Users\Admin\AppData\Local\Temp\a\POWERPOINT.exe" "C:\Users\Admin\AppData\Roaming\USD.exe" && ping 127.0.0.1 -n 15 > nul && "C:\Users\Admin\AppData\Roaming\USD.exe"3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 154⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 154⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\USD.exe"C:\Users\Admin\AppData\Roaming\USD.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\USD.exe"C:\Users\Admin\AppData\Roaming\USD.exe"5⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10968 -s 11205⤵
- Program crash
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\WORDS.exe"C:\Users\Admin\AppData\Local\Temp\a\WORDS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\WORDS.exe"C:\Users\Admin\AppData\Local\Temp\a\WORDS.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WORDS.exe"C:\Users\Admin\AppData\Local\Temp\a\WORDS.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\s.exe"C:\Users\Admin\AppData\Local\Temp\a\s.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1_241124312.exe"C:\Users\Admin\AppData\Local\Temp\1_241124312.exe"3⤵
-
C:\ProgramData\dxgbq.exe"C:\ProgramData\dxgbq.exe" /r4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2_241131218.exe"C:\Users\Admin\AppData\Local\Temp\2_241131218.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3_241134937.exe"C:\Users\Admin\AppData\Local\Temp\3_241134937.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\3_241134937.exe"C:\Users\Admin\AppData\Local\Temp\3_241134937.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\4_241144171.exe"C:\Users\Admin\AppData\Local\Temp\4_241144171.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1_241232750.exe"C:\Users\Admin\AppData\Local\Temp\1_241232750.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2_241236781.exe"C:\Users\Admin\AppData\Local\Temp\2_241236781.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3_241246953.exe"C:\Users\Admin\AppData\Local\Temp\3_241246953.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\3_241246953.exe"C:\Users\Admin\AppData\Local\Temp\3_241246953.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\4_241258515.exe"C:\Users\Admin\AppData\Local\Temp\4_241258515.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\rad.exe"C:\Users\Admin\AppData\Local\Temp\a\rad.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\clp.exe"C:\Users\Admin\AppData\Local\Temp\a\clp.exe"2⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Google Chrome DeskUpdate"3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Google Chrome DeskUpdate" /tr "C:\Users\Admin\AppData\Roaming\swibu.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\swibu.exe"C:\Users\Admin\AppData\Roaming\swibu.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\swibu.exe"C:\Users\Admin\AppData\Roaming\swibu.exe"4⤵
-
C:\Windows\explorer.exeexplorer.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\xeno%20rat%20server.exe"C:\Users\Admin\AppData\Local\Temp\a\xeno%20rat%20server.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\xeno%20rat%20client.exe"C:\Users\Admin\AppData\Local\Temp\a\xeno%20rat%20client.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\build.exe"C:\Users\Admin\AppData\Local\Temp\a\build.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Bridge.exe"C:\Users\Admin\AppData\Local\Temp\a\Bridge.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ISS Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5B24.tmp"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ISS Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7043.tmp"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Setup.exe"C:\Users\Admin\AppData\Local\Temp\a\Setup.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\shost.exe"C:\Users\Admin\AppData\Local\Temp\a\shost.exe"2⤵
-
C:\Users\Admin\AppData\Local\Programs\USD.exeC:\Users\Admin\AppData\Local\Programs\USD.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\AFkzsPYF66VLCjs.exe"C:\Users\Admin\AppData\Local\Temp\a\AFkzsPYF66VLCjs.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\AFkzsPYF66VLCjs.exe"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\AFkzsPYF66VLCjs.exe"C:\Users\Admin\AppData\Local\Temp\a\AFkzsPYF66VLCjs.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\hMSkZgr1VlC14nT.exe"C:\Users\Admin\AppData\Local\Temp\a\hMSkZgr1VlC14nT.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\hMSkZgr1VlC14nT.exe"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\hMSkZgr1VlC14nT.exe"C:\Users\Admin\AppData\Local\Temp\a\hMSkZgr1VlC14nT.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\cd4.exe"C:\Users\Admin\AppData\Local\Temp\a\cd4.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\cd4.exe"C:\Users\Admin\AppData\Local\Temp\a\cd4.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\fcPgnRwkCjpeOjh.exe"C:\Users\Admin\AppData\Local\Temp\a\fcPgnRwkCjpeOjh.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\fcPgnRwkCjpeOjh.exe"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\fcPgnRwkCjpeOjh.exe"C:\Users\Admin\AppData\Local\Temp\a\fcPgnRwkCjpeOjh.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\fcPgnRwkCjpeOjh.exe"C:\Users\Admin\AppData\Local\Temp\a\fcPgnRwkCjpeOjh.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\fcPgnRwkCjpeOjh.exe"C:\Users\Admin\AppData\Local\Temp\a\fcPgnRwkCjpeOjh.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\javawe.exe"C:\Users\Admin\AppData\Local\Temp\a\javawe.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\rate.exe"C:\Users\Admin\AppData\Local\Temp\a\rate.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\arce.exe"C:\Users\Admin\AppData\Local\Temp\a\arce.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\PDF24Creator.exe"C:\Users\Admin\AppData\Local\Temp\a\PDF24Creator.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\SourceTree.exe"C:\Users\Admin\AppData\Local\Temp\a\SourceTree.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\fontdrvhost.exe"C:\Users\Admin\AppData\Local\Temp\a\fontdrvhost.exe"2⤵
-
C:\Windows\SysWOW64\Dllhost.exe"C:\Windows\SysWOW64\Dllhost.exe"3⤵
-
-
-
C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\CE574991.exe"C:\Users\Admin\AppData\Local\Temp\a\CE574991.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\CE574991.exe"C:\Users\Admin\AppData\Local\Temp\a\CE574991.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\LRCnaco7v7VKgmM.exe"C:\Users\Admin\AppData\Local\Temp\a\LRCnaco7v7VKgmM.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\e55GjJTFITXYsH4.exe"C:\Users\Admin\AppData\Local\Temp\a\e55GjJTFITXYsH4.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\UmN21TAqpWTaFfk.exe"C:\Users\Admin\AppData\Local\Temp\a\UmN21TAqpWTaFfk.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 14148 -s 8323⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\jqqvLru0VAiH3z.exe"C:\Users\Admin\AppData\Local\Temp\a\jqqvLru0VAiH3z.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\WrappedObject\TypeId.exeC:\Users\Admin\AppData\Roaming\WrappedObject\TypeId.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\WrappedObject\TypeId.exeC:\Users\Admin\AppData\Roaming\WrappedObject\TypeId.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\45ce92f0b12d4665956c13e36bbbe782 /t 2240 /p 26921⤵
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe/c manage-bde -protectors -get C: -Type recoverypassword2⤵
-
C:\Windows\system32\manage-bde.exemanage-bde -protectors -get C: -Type recoverypassword3⤵
-
-
-
C:\Windows\system32\cmd.exe/c manage-bde -protectors -get F: -Type recoverypassword2⤵
-
C:\Windows\system32\manage-bde.exemanage-bde -protectors -get F: -Type recoverypassword3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeC:\Users\Admin\AppData\Roaming\SubDir\Client.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\winmgr\syswinprdrvc.exeC:\ProgramData\winmgr\syswinprdrvc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dwm.exedwm.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AA7A2B6E818C3564CF2C34F0C4C74B462⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 951D1A1F04E6291135DC348B51DAAD26 E Global\MSI00002⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\KI6Doqb.exeC:\Users\Admin\AppData\Local\Temp\a\KI6Doqb.exe --service1⤵
-
C:\Windows\system32\getmac.exe"getmac" /fo csv /nh2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" diskdrive get serialnumber /format:csv2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" csproduct get uuid /format:csv2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\KI6Doqb.exeC:\Users\Admin\AppData\Local\Temp\a\KI6Doqb.exe1⤵
-
C:\Windows\system32\getmac.exe"getmac" /fo csv /nh2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" diskdrive get serialnumber /format:csv2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" csproduct get uuid /format:csv2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\syschnu.exeC:\Users\Admin\AppData\Local\Temp\a\syschnu.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Software.exeC:\Users\Admin\AppData\Local\Temp\a\Software.exe1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\svchron.exeC:\Users\Admin\AppData\Local\Temp\a\svchron.exe1⤵
-
C:\Windows\syscnrhost.exeC:\Windows\syscnrhost.exe1⤵
-
C:\Windows\syscnrhost.exeC:\Windows\syscnrhost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\svchron.exe"C:\Users\Admin\AppData\Local\Temp\a\svchron.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\syscnrhost.exeC:\Windows\syscnrhost.exe1⤵
-
C:\Users\Admin\AppData\Roaming\WrappedObject\TypeId.exeC:\Users\Admin\AppData\Roaming\WrappedObject\TypeId.exe1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\yidmyj.exeC:\Users\Admin\AppData\Roaming\yidmyj.exe1⤵
-
C:\Users\Admin\AppData\Roaming\WindowsSystemDiagnostics.{D20EA4E1-3957-11D2-A40B-0C5020524153}\spooIsv.exeC:\Users\Admin\AppData\Roaming\WindowsSystemDiagnostics.{D20EA4E1-3957-11D2-A40B-0C5020524153}\spooIsv.exe1⤵
-
C:\Windows\system32\cmd.execmd.exe /C schtasks /query /tn MicrosoftEdgeUpdateTaskMachineUPAS2⤵
-
C:\Windows\system32\schtasks.exeschtasks /query /tn MicrosoftEdgeUpdateTaskMachineUPAS3⤵
-
-
-
C:\Users\Admin\AppData\Local\eIKUOTy44azX.exeC:\Users\Admin\AppData\Local\eIKUOTy44azX.exe1⤵
-
C:\Users\Admin\AppData\Roaming\yidmyj.exeC:\Users\Admin\AppData\Roaming\yidmyj.exe1⤵
-
C:\Users\Admin\AppData\Roaming\WindowsSystemDiagnostics.{D20EA4E1-3957-11D2-A40B-0C5020524153}\spooIsv.exeC:\Users\Admin\AppData\Roaming\WindowsSystemDiagnostics.{D20EA4E1-3957-11D2-A40B-0C5020524153}\spooIsv.exe1⤵
-
C:\Windows\system32\cmd.execmd.exe /C schtasks /query /tn MicrosoftEdgeUpdateTaskMachineUPAS2⤵
-
-
C:\ProgramData\dbffbcafec.exeC:\ProgramData\dbffbcafec.exe1⤵
-
C:\ProgramData\dbffbcafec.exeC:\ProgramData\dbffbcafec.exe1⤵
-
C:\ProgramData\dbffbcafec.exe"C:\ProgramData\dbffbcafec.exe"1⤵
-
C:\ProgramData\demohost_std\TransmitteD.exeC:\ProgramData\demohost_std\TransmitteD.exe1⤵
-
C:\Users\Admin\AppData\Local\ElevateMoni.exeC:\Users\Admin\AppData\Local\ElevateMoni.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\demohost_std\XPFix.exe"C:\Users\Admin\AppData\Roaming\demohost_std\XPFix.exe" "C:\Users\Admin\AppData\Roaming\demohost_std\XPFix.exe" /u2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\ProgramData\systemdrv.exeC:\ProgramData\systemdrv.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Users\Admin\AppData\Roaming\swibu.exeC:\Users\Admin\AppData\Roaming\swibu.exe1⤵
-
C:\Users\Admin\AppData\Roaming\swibu.exe"C:\Users\Admin\AppData\Roaming\swibu.exe"2⤵
-
C:\Windows\explorer.exeexplorer.exe3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\swibu.exeC:\Users\Admin\AppData\Roaming\swibu.exe1⤵
-
C:\Users\Admin\AppData\Roaming\swibu.exe"C:\Users\Admin\AppData\Roaming\swibu.exe"2⤵
-
C:\Windows\explorer.exeexplorer.exe3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\swibu.exeC:\Users\Admin\AppData\Roaming\swibu.exe1⤵
-
C:\Users\Admin\AppData\Roaming\swibu.exe"C:\Users\Admin\AppData\Roaming\swibu.exe"2⤵
-
C:\Windows\explorer.exeexplorer.exe3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\swibu.exeC:\Users\Admin\AppData\Roaming\swibu.exe1⤵
-
C:\Users\Admin\AppData\Roaming\swibu.exe"C:\Users\Admin\AppData\Roaming\swibu.exe"2⤵
-
C:\Windows\explorer.exeexplorer.exe3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\swibu.exeC:\Users\Admin\AppData\Roaming\swibu.exe1⤵
-
C:\Users\Admin\AppData\Roaming\swibu.exe"C:\Users\Admin\AppData\Roaming\swibu.exe"2⤵
-
C:\Windows\explorer.exeexplorer.exe3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\swibu.exeC:\Users\Admin\AppData\Roaming\swibu.exe1⤵
-
C:\Users\Admin\AppData\Roaming\swibu.exe"C:\Users\Admin\AppData\Roaming\swibu.exe"2⤵
-
C:\Windows\explorer.exeexplorer.exe3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\swibu.exeC:\Users\Admin\AppData\Roaming\swibu.exe1⤵
-
C:\Users\Admin\AppData\Roaming\swibu.exe"C:\Users\Admin\AppData\Roaming\swibu.exe"2⤵
-
C:\Windows\explorer.exeexplorer.exe3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\swibu.exeC:\Users\Admin\AppData\Roaming\swibu.exe1⤵
-
C:\Users\Admin\AppData\Roaming\swibu.exe"C:\Users\Admin\AppData\Roaming\swibu.exe"2⤵
-
C:\Windows\explorer.exeexplorer.exe3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\USD.exeC:\Users\Admin\AppData\Roaming\USD.exe1⤵
-
C:\Users\Admin\AppData\Roaming\USD.exe"C:\Users\Admin\AppData\Roaming\USD.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\USD.exe"C:\Users\Admin\AppData\Roaming\USD.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\swibu.exeC:\Users\Admin\AppData\Roaming\swibu.exe1⤵
-
C:\Users\Admin\AppData\Roaming\swibu.exe"C:\Users\Admin\AppData\Roaming\swibu.exe"2⤵
-
C:\Windows\explorer.exeexplorer.exe3⤵
-
-
-
C:\ProgramData\systemdrv.exeC:\ProgramData\systemdrv.exe1⤵
-
C:\ProgramData\dbffbcafec.exeC:\ProgramData\dbffbcafec.exe1⤵
-
C:\ProgramData\Chrome\chrome_updater.exeC:\ProgramData\Chrome\chrome_updater.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\USD.exeC:\Users\Admin\AppData\Roaming\USD.exe1⤵
-
C:\Users\Admin\AppData\Roaming\USD.exe"C:\Users\Admin\AppData\Roaming\USD.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\yidmyj.exeC:\Users\Admin\AppData\Roaming\yidmyj.exe1⤵
-
C:\Users\Admin\AppData\Roaming\USD.exeC:\Users\Admin\AppData\Roaming\USD.exe1⤵
-
C:\Users\Admin\AppData\Roaming\USD.exe"C:\Users\Admin\AppData\Roaming\USD.exe"2⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\fold.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\fold.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\fold.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\fold.exe"2⤵
-
-
C:\ProgramData\update.exeC:\ProgramData\update.exe1⤵
-
C:\Program Files (x86)\ISS Monitor\issmon.exe"C:\Program Files (x86)\ISS Monitor\issmon.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files (x86)\ISS Monitor\issmon.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "7768" "1824" "1792" "1868" "0" "0" "1872" "0" "0" "0" "0" "0"3⤵
-
-
-
C:\Program Files (x86)\ISS Monitor\issmon.exe"C:\Program Files (x86)\ISS Monitor\issmon.exe"2⤵
-
-
C:\Program Files (x86)\ISS Monitor\issmon.exe"C:\Program Files (x86)\ISS Monitor\issmon.exe"2⤵
-
-
C:\Program Files (x86)\ISS Monitor\issmon.exe"C:\Program Files (x86)\ISS Monitor\issmon.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 11483⤵
- Program crash
-
-
-
C:\Program Files (x86)\ISS Monitor\issmon.exe"C:\Program Files (x86)\ISS Monitor\issmon.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files (x86)\ISS Monitor\issmon.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files (x86)\ISS Monitor\issmon.exe"C:\Program Files (x86)\ISS Monitor\issmon.exe"2⤵
-
-
C:\Program Files (x86)\ISS Monitor\issmon.exe"C:\Program Files (x86)\ISS Monitor\issmon.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 14916 -s 10083⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6852 -s 17603⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"C:\Users\Admin\AppData\Local\Temp\a\VHVD9UGu8Er4rnQ.exe"2⤵
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 14916 -ip 149161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6852 -ip 68521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 14148 -ip 141481⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3340 -ip 33401⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa31cb855 /state1:0x41c64e6d1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"1⤵
- Command and Scripting Interpreter: PowerShell
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
3Service Execution
3Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
2Disable or Modify System Firewall
1Indicator Removal
1File Deletion
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
MeshAgent.db
MeshAgent.db.tmp
firefox.exe.sig
mozavutil.dll
nssckbi.dll
8hdblsYkwrHW
state.rsm
YZJb6v4lDVIZ
Ylmo9MRDAUpb
logs.dat
CookAutoFDllOpFire.dll
DocumentGrabber.dll
ExtentWallet.dll
FileZilla.dll
Google_Chrome_Web_Data_temp
WalletSorterDLL.dll
additional_tool.exe
another_tool.exe
chrome_inject.exe
extra_tool.exe
my_new_dll.dll
steam_config_backup.dll
TypeId.exe.log
build.exe.log
SourceTree.exe.log
issmon.exe.log
1_241124312.exe
2442181879.msi
3_241134937.exe
4_241144171.exe
Enclosure.scr
H
Actually.wms
Ago
Allen
Bangbus.wms
Catholic
Conjunction.wms
Fitness
Great
Haiti
Make.wms
Mutual
Organize
Pet.wms
Psp
Referral.wms
Remembered
Settled.wms
Silver
Sing.wms
Which
INSTALLER
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_wmi.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
libcrypto-3.dll
libffi-8.dll
python312.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
200.ico
BrowserInstaller.exe
IRZip.lmd
Wow64.lmd
irsetup.exe
lua5.3.dll
02.08.2022.exe
06bK6nU.exe
0rXld4E.exe
1BOi0tXTJJWgZS1BzlecvJPgUWQPYe3K.exe
1yb0enm.exe
2O7gWSz.exe
32.exe
8GVk01wwWXHHto7BJ1pwBajM8YOnUuQf.exe
8RsL970.exe
AFkzsPYF66VLCjs.exe
Bridge.exe
C8c1bbe.exe
CE574991.exe
Client-built.exe
ClipAid-Pro.exe
Clipper.exe
GL0ygTD.exe
HCBSXXl.exe
Injector.exe
KI6Doqb.exe
LRCnaco7v7VKgmM.exe
MSTeams.exe
Minere.exe
NOTEPAD.exe
PDF24Creator.exe
POWERPOINT.exe
Software.exe
SourceTree.exe
Stealc.exe
TLauncher-Installer-1.9.4.exe
VHVD9UGu8Er4rnQ.exe
WORDS.exe
ZAjTMWu.exe
a-89fb7017-7780-4b72-950d-c2db1146a34a.exe
arce.exe
build.exe
cd4.exe
clp.exe
cooking.exe
crypted.exe
crypted_guardfile.exe
dPzCoRY.exe
dfdsvc.exe
dropper64.exe
dva.exe
e55GjJTFITXYsH4.exe
elf.exe
fcPgnRwkCjpeOjh.exe
fontdrvhost.exe
fz0oKy4.exe
fzCgCtE.exe
hMSkZgr1VlC14nT.exe
javawe.exe
jqqvLru0VAiH3z.exe
lJ5IwxN.exe
ldplayer9_ld_407586_ld.exe
newtpp.exe
nonrendition.exe
pitchometer.exe
rabert.exe
rad.exe
random.exe
rate.exe
rh_0.9.3.exe
s.exe
server.exe
shost.exe
sup.exe
svchron.exe
sys.exe
syschnu.exe
tmp.exe
v.exe
vnc.exe
x.exe
x64-setup.exe
xeno%20rat%20client.exe
xeno%20rat%20server.exe
xeno.exe
xiobv.exe
xmr.exe
xobi.exe
xtest.exe
yyy.exe
tmp7FC5.tmp
the-real-index
the-real-index~RFe5f4a60.TMP
CURRENT
MANIFEST-000001
History
SCT Auditing Pending Reports
32.png
48.png
64.png
128.png
a9031b7a-a1f0-434f-b0ce-6f45177873b8.tmp
data_0
data_1
data_2
data_3
Local State
Local State
Local State~RFe5f02c8.TMP
iptpub.json
iptpub.json
iptpub.json
iptpub.json
iptpub.tmp
ipts.json
ks_hs_blind_id+20401_1440_43200.ed25519_expanded_private
ks_hs_blind_id+20402_1440_43200.ed25519_expanded_private
ks_hs_desc_sign+20401_1440_43200.ed25519_private
ks_hs_desc_sign+20402_1440_43200.ed25519_private
ks_hs_id.ed25519_expanded_private
guards.json
swibu.exe
con_microdesc_sha3-256-8083149d6c508ecbc5373f41e0ccbeb6fbad80a8c66708317a30e9423aba3360
iptpub.json
iptpub.json
iptpub.json
iptpub.json
iptpub.json
iptpub.json
iptpub.tmp
iptpub.tmp
ipts.json
ipts.json
ks_hs_blind_id+20401_1440_43200.ed25519_expanded_private
ks_hs_blind_id+20402_1440_43200.ed25519_expanded_private
ks_hs_desc_sign+20401_1440_43200.ed25519_private
ks_hs_desc_sign+20402_1440_43200.ed25519_private
ks_hs_id.ed25519_expanded_private
circuit_timeouts.json
guards.json
guards.json
__PSScriptPolicyTest_an0ebzvo.ysb.ps1
~temp.tmp
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
memory/200-12330-0x0000000000400000-0x0000000000687000-memory.dmp
memory/200-12475-0x0000000000400000-0x0000000000687000-memory.dmp
memory/876-12242-0x0000022266640000-0x0000022266670000-memory.dmp
memory/876-12241-0x0000022266080000-0x0000022266206000-memory.dmp
memory/1160-746-0x00007FFC7B820000-0x00007FFC7BA29000-memory.dmp
memory/1548-12411-0x0000000000B80000-0x0000000000B96000-memory.dmp
memory/1568-684-0x0000000140000000-0x00000001400354C0-memory.dmp
memory/1568-679-0x0000000000630000-0x0000000000669000-memory.dmp
memory/2040-12485-0x0000000006210000-0x000000000621A000-memory.dmp
memory/2344-737-0x0000000140000000-0x0000000140004278-memory.dmp
memory/2548-13036-0x00007FFC70170000-0x00007FFC7017D000-memory.dmp
memory/2548-13022-0x00007FFC6BC10000-0x00007FFC6BC3D000-memory.dmp
memory/2548-13179-0x00007FFC6BD40000-0x00007FFC6BD52000-memory.dmp
memory/2548-13180-0x00007FFC68870000-0x00007FFC6887C000-memory.dmp
memory/2548-13158-0x00007FFC6C910000-0x00007FFC6C91B000-memory.dmp
memory/2548-13172-0x00007FFC55970000-0x00007FFC55A3E000-memory.dmp
memory/2548-13173-0x00007FFC622B0000-0x00007FFC622D4000-memory.dmp
memory/2548-13171-0x00007FFC61180000-0x00007FFC611B3000-memory.dmp
memory/2548-13162-0x00007FFC6BC10000-0x00007FFC6BC3D000-memory.dmp
memory/2548-13163-0x00007FFC68120000-0x00007FFC68139000-memory.dmp
memory/2548-13170-0x00007FFC53540000-0x00007FFC53A73000-memory.dmp
memory/2548-13164-0x00007FFC718B0000-0x00007FFC718BD000-memory.dmp
memory/2548-13166-0x00007FFC6CB70000-0x00007FFC6CB7F000-memory.dmp
memory/2548-13167-0x00007FFC62300000-0x00007FFC62316000-memory.dmp
memory/2548-13165-0x00007FFC70170000-0x00007FFC7017D000-memory.dmp
memory/2548-13159-0x00007FFC70370000-0x00007FFC70395000-memory.dmp
memory/2548-13160-0x00007FFC718C0000-0x00007FFC718CF000-memory.dmp
memory/2548-13161-0x00007FFC70BD0000-0x00007FFC70BEA000-memory.dmp
memory/2548-13102-0x00007FFC70370000-0x00007FFC70395000-memory.dmp
memory/2548-13061-0x00007FFC53CF0000-0x00007FFC53E79000-memory.dmp
memory/2548-13062-0x00007FFC6BD40000-0x00007FFC6BD52000-memory.dmp
memory/2548-13063-0x00007FFC68870000-0x00007FFC6887C000-memory.dmp
memory/2548-13064-0x00007FFC61000000-0x00007FFC6102A000-memory.dmp
memory/2548-13065-0x00007FFC5B5D0000-0x00007FFC5B5FF000-memory.dmp
memory/2548-13067-0x00007FFC6C910000-0x00007FFC6C91B000-memory.dmp
memory/2548-13066-0x00007FFC54620000-0x00007FFC54CE8000-memory.dmp
memory/2548-13060-0x00007FFC622B0000-0x00007FFC622D4000-memory.dmp
memory/2548-13055-0x00007FFC61180000-0x00007FFC611B3000-memory.dmp
memory/2548-13056-0x00007FFC55970000-0x00007FFC55A3E000-memory.dmp
memory/2548-13044-0x00007FFC53540000-0x00007FFC53A73000-memory.dmp
memory/2548-13043-0x00007FFC62300000-0x00007FFC62316000-memory.dmp
memory/2548-13035-0x00007FFC718B0000-0x00007FFC718BD000-memory.dmp
memory/2548-13034-0x00007FFC68120000-0x00007FFC68139000-memory.dmp
memory/2548-13037-0x00007FFC6CB70000-0x00007FFC6CB7F000-memory.dmp
memory/2548-13021-0x00007FFC70BD0000-0x00007FFC70BEA000-memory.dmp
memory/2548-13178-0x00007FFC53CF0000-0x00007FFC53E79000-memory.dmp
memory/2548-13020-0x00007FFC718C0000-0x00007FFC718CF000-memory.dmp
memory/2548-13019-0x00007FFC70370000-0x00007FFC70395000-memory.dmp
memory/2548-13011-0x00007FFC54620000-0x00007FFC54CE8000-memory.dmp
memory/2600-3364-0x0000000140000000-0x00000001400354C0-memory.dmp
memory/2600-702-0x0000000000510000-0x0000000000549000-memory.dmp
memory/2600-700-0x0000000140000000-0x00000001400354C0-memory.dmp
memory/2692-1562-0x0000000000BB0000-0x00000000011B1000-memory.dmp
memory/2692-126-0x0000000000BB0000-0x00000000011B1000-memory.dmp
memory/2792-12215-0x000002CF75FC0000-0x000002CF75FCA000-memory.dmp
memory/2792-12217-0x000002CF75FF0000-0x000002CF75FFA000-memory.dmp
memory/2792-12218-0x000002CF76250000-0x000002CF7626A000-memory.dmp
memory/2792-12219-0x000002CF76210000-0x000002CF76218000-memory.dmp
memory/2792-12220-0x000002CF76220000-0x000002CF76226000-memory.dmp
memory/2792-12221-0x000002CF76270000-0x000002CF7627A000-memory.dmp
memory/2792-12216-0x000002CF76230000-0x000002CF7624C000-memory.dmp
memory/2792-12214-0x000002CF76150000-0x000002CF76203000-memory.dmp
memory/2792-12213-0x000002CF75FD0000-0x000002CF75FEC000-memory.dmp
memory/3136-12439-0x0000000000E30000-0x0000000000E42000-memory.dmp
memory/3172-772-0x0000000000400000-0x0000000000433000-memory.dmp
memory/3196-94-0x000002304E810000-0x000002304E8B0000-memory.dmp
memory/3196-95-0x0000023050510000-0x0000023050910000-memory.dmp
memory/3196-91-0x000002304E810000-0x000002304E8B0000-memory.dmp
memory/3196-99-0x00007FFC78F20000-0x00007FFC79294000-memory.dmp
memory/3196-98-0x00007FFC7AD40000-0x00007FFC7ADFD000-memory.dmp
memory/3196-97-0x00007FFC7B820000-0x00007FFC7BA29000-memory.dmp
memory/3196-96-0x0000023050510000-0x0000023050910000-memory.dmp
memory/3196-92-0x000002304E810000-0x000002304E8B0000-memory.dmp
memory/4052-670-0x00007FF6A3920000-0x00007FF6A3F9B000-memory.dmp
memory/4052-2328-0x00007FF6A3920000-0x00007FF6A3F9B000-memory.dmp
memory/4208-728-0x0000000140000000-0x00000001400354C0-memory.dmp
memory/4444-2-0x000000001B6B0000-0x000000001B6C0000-memory.dmp
memory/4444-1-0x000000001B6B0000-0x000000001B6C0000-memory.dmp
memory/4444-0-0x00000000007B0000-0x00000000007B8000-memory.dmp
memory/4628-12428-0x0000000000750000-0x000000000075E000-memory.dmp
memory/4808-781-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-849-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-3639-0x000000001CD60000-0x000000001CDAC000-memory.dmp
memory/4808-3640-0x000000001DDD0000-0x000000001DE24000-memory.dmp
memory/4808-780-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-778-0x0000000000FA0000-0x000000000104C000-memory.dmp
memory/4808-787-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-790-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-795-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-803-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-807-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-809-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-813-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-825-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-783-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-791-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-793-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-797-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-799-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-801-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-805-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-811-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-815-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-817-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-819-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-821-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-779-0x000000001CC50000-0x000000001CD5E000-memory.dmp
memory/4808-823-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-845-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-827-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-829-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-831-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-833-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-835-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-837-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-839-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-841-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-843-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-847-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-3638-0x0000000001F30000-0x0000000001F86000-memory.dmp
memory/4808-851-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-853-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-855-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-858-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-859-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-861-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-865-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-867-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-869-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-785-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-871-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-873-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-875-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-877-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-881-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-879-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/4808-863-0x000000001CC50000-0x000000001CD5A000-memory.dmp
memory/5412-12549-0x0000000140000000-0x00000001408AD000-memory.dmp
memory/5412-12777-0x0000000140000000-0x00000001408AD000-memory.dmp
memory/5556-12181-0x000001A8D3880000-0x000001A8D38C6000-memory.dmp
memory/5556-12179-0x000001A8D33B0000-0x000001A8D33D2000-memory.dmp
memory/5580-12263-0x00000201C0A80000-0x00000201C0A9A000-memory.dmp
memory/5580-12257-0x00000201C0980000-0x00000201C09E2000-memory.dmp
memory/5580-12258-0x00000201C0A00000-0x00000201C0A42000-memory.dmp
memory/5580-12259-0x00000201C05D0000-0x00000201C05DA000-memory.dmp
memory/5580-12260-0x00000201C0A40000-0x00000201C0A52000-memory.dmp
memory/5580-12261-0x00000201C0AA0000-0x00000201C0ADC000-memory.dmp
memory/5580-12256-0x00000201C06E0000-0x00000201C06E8000-memory.dmp
memory/5580-12262-0x00000201C09E0000-0x00000201C09EA000-memory.dmp
memory/5580-12264-0x00000201C0D80000-0x00000201C0DB8000-memory.dmp
memory/5580-12255-0x00000201C0950000-0x00000201C0976000-memory.dmp
memory/5580-12254-0x00000201C05C0000-0x00000201C05CA000-memory.dmp
memory/6136-12454-0x0000000005870000-0x0000000005882000-memory.dmp
memory/6136-12455-0x0000000005DA0000-0x0000000005DDC000-memory.dmp
memory/6136-12453-0x0000000004B60000-0x0000000004BC6000-memory.dmp
memory/6136-12451-0x0000000004AC0000-0x0000000004B52000-memory.dmp
memory/6136-12450-0x0000000004F80000-0x0000000005526000-memory.dmp
memory/6136-12449-0x0000000000060000-0x00000000000BE000-memory.dmp
memory/6472-12745-0x000000001AE70000-0x000000001B032000-memory.dmp
memory/6472-12744-0x0000000000010000-0x000000000001E000-memory.dmp