Resubmissions
06/11/2026, 14:36
261106-rylrnaxz9r1004/11/2026, 21:57
261104-1txsssvwgz03/11/2026, 22:02
261103-1xxxzazy2l1003/11/2026, 21:57
261103-1t4lcawwes1003/11/2026, 21:50
261103-1p66nsfx2r1003/11/2026, 21:48
261103-1n9keazx5r1026/10/2026, 02:22
261026-ctm2lazv7j1024/10/2026, 06:44
261024-hhl8taxx2r23/10/2026, 16:14
261023-tpvpbatt6q1018/10/2026, 12:47
261018-p1by5acz5n10Analysis
- user interaction
yes - max time kernel
215s - max time network
449s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-ja - resource tags
- submitted
19/06/2026, 04:32
Errors
General
- Target Synaptics.exe
- Size 764KB
- Sample260619-e5zwmsfs2v
- SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
C:\Users\Admin\AppData\Local\Temp\Files\!Please Read Me!.txt
-
wannacry
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
-
15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Extracted
-
risepro
-
3.36.173.8:50500
Extracted
-
amadey
-
5.60
-
1b2025
-
http://microsoft-telemetry.cc
-
http://xboxtelemetry-defender.cc
-
strings_key
b33ebf101e5565bbfe8670bcfe79b946
-
url_paths
/cvdfnaFJBmC0/index.php
/cvdfnaFJBmC1/index.php
/cvdfnaFJBmC2/index.php
Signatures
- Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Family: RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Family: Wannacry
WannaCry is a ransomware cryptoworm.
- Family: Xred
Xred is backdoor written in Delphi.
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 2 IoCs
- Detects Amadey x86-bit Payload 4 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
- Contacts a large (7079) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Downloads MZ/PE file 44 IoCs
- Manipulates Digital Signatures 1 TTPs 2 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Signed with revoked ConnectWise certificate 3 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- Uses browser remote debugging 2 TTPs 9 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
- Drops startup file 4 IoCs
- Executes dropped EXE 23 IoCs
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
Network activity triggered a Suricata alert
- Adds Run key to start application 2 TTPs 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Drops desktop.ini file(s) 1 IoCs
- ConfuserEx .NET packer 3 IoCs
Detects ConfuserEx .NET packer.
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 49 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Detects Pyinstaller 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 40 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 5 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 9 IoCs
- Modifies registry class 22 IoCs
- Modifies system certificate store 2 TTPs 4 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 55 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 18 IoCs
- Suspicious use of WriteProcessMemory 43 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"4⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Files\AddMeFast%20Bot.exe"C:\Users\Admin\AppData\Local\Temp\Files\AddMeFast%20Bot.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\PowerRat.exe"C:\Users\Admin\AppData\Local\Temp\Files\PowerRat.exe"4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Update.exe"C:\Users\Admin\AppData\Local\Temp\Files\Update.exe"4⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\WannaCry.exe"C:\Users\Admin\AppData\Local\Temp\Files\WannaCry.exe"4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 190841781843600.bat5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\!WannaDecryptor!.exe!WannaDecryptor!.exe f5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MSExchange*5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Microsoft.Exchange.*5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlserver.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlwriter.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\!WannaDecryptor!.exe!WannaDecryptor!.exe c5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b !WannaDecryptor!.exe v5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\!WannaDecryptor!.exe!WannaDecryptor!.exe v6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete8⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\!WannaDecryptor!.exe!WannaDecryptor!.exe5⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\LukeJazz.exe"C:\Users\Admin\AppData\Local\Temp\Files\LukeJazz.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k copy Decide Decide.cmd & Decide.cmd & exit5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 4375706⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "BASEDADVERTISEAFGHANISTANCONTENT" Sacramento6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Avi + Hits + Joyce + Desk + Cheers + Cleanup + Generate + Hobbies + Possible + Rover + Notifications + Unique + Helpful + Constantly + Namibia + Revolution + Transfers + Index + Colors 437570\b6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\437570\Ul.pif437570\Ul.pif 437570\b6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\timeout.exetimeout 56⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\file.exe"C:\Users\Admin\AppData\Local\Temp\Files\file.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MFZ5387SSG.tmp\file.tmp"C:\Users\Admin\AppData\Local\Temp\is-MFZ5387SSG.tmp\file.tmp" /SL5="$403A2,7883241,878080,C:\Users\Admin\AppData\Local\Temp\Files\file.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe"C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe"4⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"5⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 8085⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\rxd_en_1.exe"C:\Users\Admin\AppData\Local\Temp\Files\rxd_en_1.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\REXCEL~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\REXCEL~1.EXE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\net_launcher.exe"C:\Users\Admin\AppData\Local\Temp\Files\net_launcher.exe"4⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\lol.exe"C:\Users\Admin\AppData\Local\Temp\Files\lol.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe"C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe"C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe"4⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\5c937dc8b379e502\ScreenConnect.ClientSetup.msi"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\javaw.exe"C:\Users\Admin\AppData\Local\Temp\Files\javaw.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Jigsaw.exe"C:\Users\Admin\AppData\Local\Temp\Files\Jigsaw.exe"4⤵
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\Files\Jigsaw.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\HorionInjector.exe"C:\Users\Admin\AppData\Local\Temp\Files\HorionInjector.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\bjbh.exe"C:\Users\Admin\AppData\Local\Temp\Files\bjbh.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\20.exe"C:\Users\Admin\AppData\Local\Temp\Files\20.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\delfino-g3.exe"C:\Users\Admin\AppData\Local\Temp\Files\delfino-g3.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-38ITJ.tmp\delfino-g3.tmp"C:\Users\Admin\AppData\Local\Temp\is-38ITJ.tmp\delfino-g3.tmp" /SL5="$60462,30692187,121344,C:\Users\Admin\AppData\Local\Temp\Files\delfino-g3.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\UrbanVPN.exe"C:\Users\Admin\AppData\Local\Temp\Files\UrbanVPN.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\zx.exe"C:\Users\Admin\AppData\Local\Temp\Files\zx.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\zx.exe"C:\Users\Admin\AppData\Local\Temp\Files\zx.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NoMoreRansom.exe"C:\Users\Admin\AppData\Local\Temp\Files\NoMoreRansom.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\IcarusLite-v1.1.13-win.exe"C:\Users\Admin\AppData\Local\Temp\Files\IcarusLite-v1.1.13-win.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\IcarusLite-v1.1.13-win.exe"C:\Users\Admin\AppData\Local\Temp\Files\IcarusLite-v1.1.13-win.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c title Icarus Lite6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\xxx.exe"C:\Users\Admin\AppData\Local\Temp\Files\xxx.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\justpoc.exe"C:\Users\Admin\AppData\Local\Temp\Files\justpoc.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"5⤵
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox6⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fff8651c728,0x7fff8651c734,0x7fff8651c7407⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1652,i,15456845581267114871,9814301106090158720,262144 --field-trial-handle=1944,i,7929258990197063254,12878130387613891065,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:27⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,17780326739023696871,12042097398129508764,524288 --field-trial-handle=1944,i,7929258990197063254,12878130387613891065,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:117⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2092,i,11189466736306667603,16283250074139128097,524288 --field-trial-handle=1944,i,7929258990197063254,12878130387613891065,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:137⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2904,i,3449753323240415163,6865997172210839086,2097152 --field-trial-handle=1944,i,7929258990197063254,12878130387613891065,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:17⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2908,i,8264842036669316368,3919397744656477470,2097152 --field-trial-handle=1944,i,7929258990197063254,12878130387613891065,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:17⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4132,i,5102647897313758081,7918710583741204815,524288 --field-trial-handle=1944,i,7929258990197063254,12878130387613891065,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:147⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox6⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fff8651c728,0x7fff8651c734,0x7fff8651c7407⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox6⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fff8651c728,0x7fff8651c734,0x7fff8651c7407⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1612,i,9133446955282933600,13136924166871998578,262144 --field-trial-handle=2520,i,4018978448535631887,11168066667277614589,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:27⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,2795271599783676314,139390528785765660,524288 --field-trial-handle=2520,i,4018978448535631887,11168066667277614589,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:117⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=1972,i,15997858164232591315,12976269680477429857,524288 --field-trial-handle=2520,i,4018978448535631887,11168066667277614589,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:137⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2856,i,10906885494137840678,8792657553235042362,2097152 --field-trial-handle=2520,i,4018978448535631887,11168066667277614589,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:17⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2864,i,9525116488526912429,18081679241170318200,2097152 --field-trial-handle=2520,i,4018978448535631887,11168066667277614589,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:17⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4008,i,8647816583205326240,11967988274151531869,524288 --field-trial-handle=2520,i,4018978448535631887,11168066667277614589,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:147⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox6⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fff8651c728,0x7fff8651c734,0x7fff8651c7407⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox6⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fff8651c728,0x7fff8651c734,0x7fff8651c7407⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Silentum_Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\Files\Silentum_Spoofer.exe"4⤵
-
C:\Users\Admin\AppData\Local\1d906327-f961-4db4-a5df-6611d2986b18\background.exe"C:\Users\Admin\AppData\Local\1d906327-f961-4db4-a5df-6611d2986b18\background.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Annabelle.exe"C:\Users\Admin\AppData\Local\Temp\Files\Annabelle.exe"4⤵
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\NetSh.exeNetSh Advfirewall set allprofiles state off5⤵
- Modifies Windows Firewall
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" -r -t 00 -f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Meredrop.exe"C:\Users\Admin\AppData\Local\Temp\Files\Meredrop.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\purchaseorder.exe"C:\Users\Admin\AppData\Local\Temp\Files\purchaseorder.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6428 -s 7485⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6428 -s 7605⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\jhgkuyyg.exe"C:\Users\Admin\AppData\Local\Temp\Files\jhgkuyyg.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\EFatura.exe"C:\Users\Admin\AppData\Local\Temp\Files\EFatura.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Files\Discord.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Files\Discord.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\btpc.exe"C:\Users\Admin\AppData\Local\Temp\Files\btpc.exe"4⤵
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TranscribeX.url" & echo URL="C:\Users\Admin\AppData\Local\AudioSync Innovations\TranscribeX.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TranscribeX.url" & exit2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\437570\Ul.pifC:\Users\Admin\AppData\Local\Temp\437570\Ul.pif2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\437570\Ul.pifC:\Users\Admin\AppData\Local\Temp\437570\Ul.pif2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH2663\MPGPH2663.exe" /tn "MPGPH2663 HR" /sc HOURLY /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH2663\MPGPH2663.exe" /tn "MPGPH2663 LG" /sc ONLOGON /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x130,0x134,0x138,0xa8,0x13c,0x7fff89d5c728,0x7fff89d5c734,0x7fff89d5c7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,13443175791604955421,2274968305623248015,524288 --field-trial-handle=2040,i,6256333349510017003,5122483904229052668,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1652,i,7118960926209663944,9373899505166691132,262144 --field-trial-handle=2040,i,6256333349510017003,5122483904229052668,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,10014995677833475440,9905862019079478580,524288 --field-trial-handle=2040,i,6256333349510017003,5122483904229052668,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3440,i,6130698608058665381,3904568720092286222,2097152 --field-trial-handle=2040,i,6256333349510017003,5122483904229052668,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3444,i,8201282389959825248,13491172661755777842,2097152 --field-trial-handle=2040,i,6256333349510017003,5122483904229052668,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=5348,i,14453516810993312451,5031410447876003294,2097152 --field-trial-handle=2040,i,6256333349510017003,5122483904229052668,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:13⤵
-
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Files\WannaCry.exe"C:\Users\Admin\AppData\Local\Temp\Files\WannaCry.exe" /r1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 157C0E1CBA7C72C6CCED5A95F5E4724B C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSID73D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240965703 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E702EE1D2FAF757A8E6F4A2A9ED3D8592⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Frfx\firefox.exeC:\Users\Admin\AppData\Roaming\Frfx\firefox.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3132 -ip 31321⤵
-
C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe"C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe"C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\c31bbnf0.exe"C:\Users\Admin\AppData\Local\Temp\c31bbnf0.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\WindowsSvc.exe"C:\Users\Admin\AppData\Roaming\WindowsSvc.exe"3⤵
-
C:\Windows\explorer.exeexplorer.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5q32zcwr.exe"C:\Users\Admin\AppData\Local\Temp\5q32zcwr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sysC:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\WindowsSvc.exeC:\Users\Admin\AppData\Roaming\WindowsSvc.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\ProgramData\Windows\csrss.exe"C:\ProgramData\Windows\csrss.exe"1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\WindowsStore.Update.exeC:\Users\Admin\AppData\Local\Microsoft\WindowsApps\WindowsStore.Update.exe1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 6428 -ip 64281⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6428 -ip 64281⤵
-
C:\Users\Admin\AppData\Local\RageMP2663\RageMP2663.exeC:\Users\Admin\AppData\Local\RageMP2663\RageMP2663.exe1⤵
-
C:\ProgramData\MPGPH2663\MPGPH2663.exeC:\ProgramData\MPGPH2663\MPGPH2663.exe1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39b1855 /state1:0x41c64e6d1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
2File Deletion
2Modify Authentication Process
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
e5d5596.rbs
s_remove_18.svg.fun
icons.png.fun
icons_ie8.gif.fun
icons_retina.png.fun
new_icons.png.fun
new_icons_retina.png.fun
rhp_world_icon.png.fun
rhp_world_icon_2x.png.fun
rhp_world_icon_hover.png.fun
rhp_world_icon_hover_2x.png.fun
rhp_world_icon.png.fun
rhp_world_icon_2x.png.fun
rhp_world_icon_hover.png.fun
rhp_world_icon_hover_2x.png.fun
example_icons.png.fun
example_icons2x.png.fun
bg_pattern_RHP.png.fun
bg_patterns_header.png.fun
illustrations.png.fun
illustrations_retina.png.fun
ui-strings.js.fun
ui-strings.js.fun
ui-strings.js.fun
bun.png.fun
cstm_brand_preview.png.fun
cstm_brand_preview2x.png.fun
dd_arrow_small.png.fun
dd_arrow_small2x.png.fun
nub.png.fun
share_icons.png.fun
share_icons2x.png.fun
ui-strings.js.fun
DisplayLanguageNames.en_US_POSIX.txt.fun
invalid32x32.gif.fun
Synaptics.exe
background.exe
02C58263E825347E83CB02F0D8560A442F612C3D.temp
064BC79283683FAC2D0AE302F50F69D22BFAD5D0.temp
1111A57EC9EA0C56E41F37C7E3695FE11A305E1C.temp
2F980712AA78C6B65CB1C454A8B39F79FF05187C.temp
30AC1D1F56A601EC2AC1A8C3515059D7622A9163.temp
364AF5A9A26DA14A85A0166E5B517C1BCA229261.temp
53C5A34F0E47AE5BB2C1951CE3A12395054CF75D.temp
58FC2496C8088F3683E10C132F1EC878E7EBCA52.temp
A8EC1C10CAA8F789C6A9480B087AB88728D09FA5.temp
E3EC67A9BD2E75E68A1FB9B502D5EC6BC634243A.temp
F63CAA1F73B4DB754943EFDA3F3E612C8468F937.temp
settings.dat
index
index
data_0
data_1
data_2
data_3
index
Local State
Local State
Local State
index
JpnDdds.dat
JpnDdds.dat
settings.dat.fun
._cache_Synaptics.exe
5q32zcwr.exe
Amounts
Basically
Box
C4895E00
Chose
Col
Coordinate
Damages
Decide
Defines
Extending
!Please Read Me!.txt
!WannaDecryptor!.exe.lnk
00000000.res
00000000.res
00000000.res
190841781843600.bat
20.exe
AddMeFast%20Bot.exe
Annabelle.exe
21.dat.fun
36.dat.fun
Discord.exe
EFatura.exe
HorionInjector.exe
IcarusLite-v1.1.13-win.exe
Jigsaw.exe
LukeJazz.exe
Meredrop.exe
NoMoreRansom.exe
PowerRat.exe
ScreenConnect.ClientSetup.exe
Silentum_Spoofer.exe
TempSpoofer.exe
Update.exe
UrbanVPN.exe
WannaCry.exe
bjbh.exe
btpc.exe
c.vbs
c.wry
c.wry
delfino-g3.exe
file.exe
javaw.exe
jhgkuyyg.exe
justpoc.exe
lol.exe
m.wry
main1.exe
net_launcher.exe
purchaseorder.exe
r.wry
rxd_en_1.exe
setup.exe
support.client.exe
svchost.exe
t.wry
u.wry
xxx.exe
zx.exe
Gif
Its
Kits
Logging
Method
Occasionally
Opera
Plains
Record
Retrieval
Rolled
Sacramento
Senator
Slim
Small
Text
__PSScriptPolicyTest_io4q4oec.azm.ps1
c31bbnf0.exe
uOoAgBjQ.xlsm
{48B9E131-BCF2-43BD-834D-30A06F7CFB1D} - OProcSessId.dat.fun
default.exc
WindowsSvc.exe
!Please Read Me!.txt.fun
!Please Read Me!.txt.fun.ANNABELLE
!WannaDecryptor!.exe.lnk.ANNABELLE
Picture.png
e5d5597.msi
memory/372-3874-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1000-123-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/1000-121-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/1292-2465-0x0000000000A10000-0x0000000000BA6000-memory.dmp
memory/1292-2486-0x0000000000A10000-0x0000000000BA6000-memory.dmp
memory/1292-2487-0x0000000000A10000-0x0000000000BA6000-memory.dmp
memory/1552-2869-0x0000000005C70000-0x0000000005F62000-memory.dmp
memory/1552-2870-0x00000000058B0000-0x000000000593C000-memory.dmp
memory/1552-2871-0x0000000005970000-0x0000000005992000-memory.dmp
memory/1552-2864-0x0000000001A30000-0x0000000001A38000-memory.dmp
memory/1552-2872-0x00000000059A0000-0x0000000005B4C000-memory.dmp
memory/1576-2954-0x00007FFF8B840000-0x00007FFF8C6F5000-memory.dmp
memory/1576-2734-0x0000027111B10000-0x0000027111B1C000-memory.dmp
memory/1576-2890-0x00007FFF8B840000-0x00007FFF8C6F5000-memory.dmp
memory/1768-215-0x00000000068C0000-0x0000000006908000-memory.dmp
memory/1768-214-0x0000000006980000-0x0000000006A8E000-memory.dmp
memory/1768-125-0x00000000056D0000-0x000000000576C000-memory.dmp
memory/1768-124-0x0000000000CF0000-0x0000000000CF8000-memory.dmp
memory/1840-3315-0x0000000000400000-0x00000000004A1000-memory.dmp
memory/2036-3528-0x00007FF77A7C0000-0x00007FF77A85E000-memory.dmp
memory/2128-189-0x0000000005430000-0x00000000059EA000-memory.dmp
memory/2128-188-0x0000000000360000-0x00000000003BA000-memory.dmp
memory/2128-192-0x0000000004F70000-0x0000000004FC6000-memory.dmp
memory/2128-191-0x0000000004D60000-0x0000000004D6A000-memory.dmp
memory/2128-190-0x0000000004E70000-0x0000000004F02000-memory.dmp
memory/2168-2846-0x0000000000920000-0x000000000098F000-memory.dmp
memory/2168-2834-0x0000000000920000-0x000000000098F000-memory.dmp
memory/2220-3288-0x0000000000A90000-0x0000000000AA0000-memory.dmp
memory/2220-3298-0x0000000002DC0000-0x0000000002DE2000-memory.dmp
memory/2220-3306-0x0000000002C70000-0x0000000002C7A000-memory.dmp
memory/2220-3303-0x0000000002C50000-0x0000000002C5A000-memory.dmp
memory/2220-3289-0x000000001B810000-0x000000001B8A4000-memory.dmp
memory/2432-3403-0x00007FFFC0580000-0x00007FFFC07E3000-memory.dmp
memory/2616-2939-0x0000000000BE0000-0x0000000000BE8000-memory.dmp
memory/2616-2956-0x000000001D180000-0x000000001D1DA000-memory.dmp
memory/2700-232-0x0000000010000000-0x0000000010012000-memory.dmp
memory/2764-3505-0x00007FF77A7C0000-0x00007FF77A85E000-memory.dmp
memory/2764-3496-0x00007FF77A7C0000-0x00007FF77A85E000-memory.dmp
memory/2808-2847-0x0000000000810000-0x000000000087F000-memory.dmp
memory/2808-2854-0x0000000000810000-0x000000000087F000-memory.dmp
memory/3052-2920-0x0000000005BB0000-0x0000000005D5C000-memory.dmp
memory/3052-2906-0x0000000003850000-0x000000000387E000-memory.dmp
memory/3052-2915-0x00000000038B0000-0x00000000038BA000-memory.dmp
memory/3052-2918-0x0000000005970000-0x00000000059FC000-memory.dmp
memory/3168-3404-0x000001C0C8D20000-0x000001C0C8D23000-memory.dmp
memory/3584-2753-0x0000000000B50000-0x0000000000C35000-memory.dmp
memory/3584-2682-0x0000000000B50000-0x0000000000C35000-memory.dmp
memory/3592-3319-0x00000229FE7F0000-0x00000229FE814000-memory.dmp
memory/3592-3321-0x00000229FE860000-0x00000229FE89E000-memory.dmp
memory/3592-3318-0x00000229FB780000-0x00000229FB788000-memory.dmp
memory/3592-3307-0x00000229FB790000-0x00000229FB84A000-memory.dmp
memory/3592-3300-0x00000229F9010000-0x00000229F9038000-memory.dmp
memory/3592-3322-0x00000229FC4A0000-0x00000229FC4AE000-memory.dmp
memory/3604-3487-0x0000000000B00000-0x0000000000B01000-memory.dmp
memory/3604-3440-0x00000000035E0000-0x00000000035E1000-memory.dmp
memory/3604-3439-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3604-3504-0x0000000140000000-0x0000000140412000-memory.dmp
memory/3964-2758-0x00000000004D0000-0x000000000090F000-memory.dmp
memory/3964-3201-0x00000000004D0000-0x000000000090F000-memory.dmp
memory/3964-2807-0x00000000004D0000-0x000000000090F000-memory.dmp
memory/3968-2769-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4056-202-0x0000000000890000-0x0000000000950000-memory.dmp
memory/4056-203-0x0000000004C80000-0x0000000004C81000-memory.dmp
memory/4120-0-0x00000000007B0000-0x00000000007B1000-memory.dmp
memory/4120-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/4120-119-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/4500-2894-0x0000000000450000-0x0000000000FD0000-memory.dmp
memory/4500-2982-0x0000000000450000-0x0000000000FD0000-memory.dmp
memory/4500-2981-0x0000000000450000-0x0000000000FD0000-memory.dmp
memory/4648-3454-0x0000000021780000-0x000000002186F000-memory.dmp
memory/4648-3665-0x0000000021780000-0x000000002186F000-memory.dmp
memory/4648-3456-0x0000000021780000-0x000000002186F000-memory.dmp
memory/4648-3835-0x0000000021780000-0x000000002186F000-memory.dmp
memory/4648-3741-0x0000000021780000-0x000000002186F000-memory.dmp
memory/4648-3724-0x0000000021780000-0x000000002186F000-memory.dmp
memory/4648-3720-0x0000000021780000-0x000000002186F000-memory.dmp
memory/4648-3880-0x0000000021780000-0x000000002186F000-memory.dmp
memory/4648-3569-0x0000000021780000-0x000000002186F000-memory.dmp
memory/4648-3539-0x0000000021780000-0x000000002186F000-memory.dmp
memory/4648-3882-0x0000000021780000-0x000000002186F000-memory.dmp
memory/4648-3457-0x0000000021780000-0x000000002186F000-memory.dmp
memory/4648-3455-0x0000000021780000-0x000000002186F000-memory.dmp
memory/4648-3881-0x0000000021780000-0x000000002186F000-memory.dmp
memory/4732-3411-0x000002294D350000-0x000002294D357000-memory.dmp
memory/5080-128-0x00007FFF806C0000-0x00007FFF806D0000-memory.dmp
memory/5080-133-0x00007FFF7DDC0000-0x00007FFF7DDD0000-memory.dmp
memory/5080-127-0x00007FFF806C0000-0x00007FFF806D0000-memory.dmp
memory/5080-129-0x00007FFF806C0000-0x00007FFF806D0000-memory.dmp
memory/5080-130-0x00007FFF806C0000-0x00007FFF806D0000-memory.dmp
memory/5080-132-0x00007FFF7DDC0000-0x00007FFF7DDD0000-memory.dmp
memory/5080-131-0x00007FFF806C0000-0x00007FFF806D0000-memory.dmp
memory/5348-766-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/5348-3173-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/5348-1734-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/5348-2035-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/5348-205-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/5420-2932-0x000000001C0B0000-0x000000001C57E000-memory.dmp
memory/5420-2931-0x00000000013D0000-0x0000000001408000-memory.dmp
memory/5420-2933-0x000000001BB00000-0x000000001BB9C000-memory.dmp
memory/5724-3499-0x0000000140000000-0x0000000140411000-memory.dmp
memory/5724-3498-0x0000000140000000-0x0000000140411000-memory.dmp
memory/5724-3502-0x0000000140000000-0x0000000140411000-memory.dmp
memory/5724-3500-0x0000000140000000-0x0000000140411000-memory.dmp
memory/5724-3501-0x0000000140000000-0x0000000140411000-memory.dmp
memory/5724-3503-0x0000000140000000-0x0000000140411000-memory.dmp
memory/5724-3497-0x0000000140000000-0x0000000140411000-memory.dmp
memory/5956-2710-0x0000021E80400000-0x0000021E80512000-memory.dmp
memory/5956-2709-0x0000021E801D0000-0x0000021E802DE000-memory.dmp
memory/5956-2930-0x0000021E00CA0000-0x0000021E00E6A000-memory.dmp
memory/5956-2764-0x0000021E00CA0000-0x0000021E00E6A000-memory.dmp
memory/5956-2704-0x0000021E7FF30000-0x0000021E800B8000-memory.dmp
memory/5956-2733-0x0000021E67540000-0x0000021E67588000-memory.dmp
memory/5956-2703-0x0000021E65800000-0x0000021E65808000-memory.dmp
memory/6056-3441-0x00007FFFC0580000-0x00007FFFC07E3000-memory.dmp
memory/6352-7737-0x000000001EF40000-0x000000001EF5E000-memory.dmp
memory/6352-7651-0x0000000000CD0000-0x0000000000CE0000-memory.dmp
memory/6352-8152-0x00000000239D0000-0x00000000239EE000-memory.dmp
memory/6352-7679-0x000000001D800000-0x000000001D816000-memory.dmp
memory/6352-7738-0x000000001EF60000-0x000000001F012000-memory.dmp
memory/6352-7757-0x000000001EF90000-0x000000001EFB0000-memory.dmp
memory/6352-7747-0x000000001F0C0000-0x000000001F110000-memory.dmp
memory/6352-7741-0x000000001F060000-0x000000001F06A000-memory.dmp
memory/6736-8207-0x000001D1212E0000-0x000001D12286E000-memory.dmp
memory/6736-7683-0x000001D105BA0000-0x000001D106B94000-memory.dmp
memory/7060-8839-0x00007FFF883C0000-0x00007FFF88476000-memory.dmp
memory/7060-8866-0x00007FFF87840000-0x00007FFF87885000-memory.dmp
memory/7060-8830-0x00007FFF88A70000-0x00007FFF88A84000-memory.dmp
memory/7060-8833-0x00007FFF93DD0000-0x00007FFF93DDF000-memory.dmp
memory/7060-8835-0x00007FFF88AC0000-0x00007FFF88AEC000-memory.dmp
memory/7060-8837-0x00007FFF92E40000-0x00007FFF92E4D000-memory.dmp
memory/7060-8767-0x00007FFF85E80000-0x00007FFF862E5000-memory.dmp
memory/7060-8838-0x00007FFF88A90000-0x00007FFF88ABE000-memory.dmp
memory/7060-8836-0x00007FFF93D90000-0x00007FFF93DA9000-memory.dmp
memory/7060-8834-0x00007FFF93DB0000-0x00007FFF93DC9000-memory.dmp
memory/7060-8831-0x00007FFF93DE0000-0x00007FFF93E04000-memory.dmp
memory/7060-8841-0x00007FFF85B00000-0x00007FFF85E74000-memory.dmp
memory/7060-8845-0x00007FFF84D30000-0x00007FFF84E9D000-memory.dmp
memory/7060-8846-0x00007FFF883A0000-0x00007FFF883B5000-memory.dmp
memory/7060-8844-0x00007FFF88A50000-0x00007FFF88A6E000-memory.dmp
memory/7060-8843-0x00007FFF92E30000-0x00007FFF92E40000-memory.dmp
memory/7060-8842-0x00000293F3010000-0x00000293F3384000-memory.dmp
memory/7060-8882-0x00007FFF93DE0000-0x00007FFF93E04000-memory.dmp
memory/7060-8883-0x00000293F3010000-0x00000293F3384000-memory.dmp
memory/7060-8848-0x00007FFF87BD0000-0x00007FFF87CE8000-memory.dmp
memory/7060-8854-0x00007FFF88380000-0x00007FFF8839C000-memory.dmp
memory/7060-8858-0x00007FFF88310000-0x00007FFF8831B000-memory.dmp
memory/7060-8857-0x00007FFF87890000-0x00007FFF878B5000-memory.dmp
memory/7060-8856-0x00007FFF8FC30000-0x00007FFF8FC3D000-memory.dmp
memory/7060-8865-0x00007FFF877F0000-0x00007FFF877FB000-memory.dmp
memory/7060-8879-0x00007FFF85B00000-0x00007FFF85E74000-memory.dmp
memory/7060-8864-0x00007FFF87800000-0x00007FFF8780B000-memory.dmp
memory/7060-8863-0x00007FFF87810000-0x00007FFF8783F000-memory.dmp
memory/7060-8880-0x00007FFF871D0000-0x00007FFF871DC000-memory.dmp
memory/7060-8874-0x00007FFF877E0000-0x00007FFF877EC000-memory.dmp
memory/7060-8875-0x00007FFF85E80000-0x00007FFF862E5000-memory.dmp
memory/7060-8876-0x00007FFF87670000-0x00007FFF8767B000-memory.dmp
memory/8276-8818-0x0000000000400000-0x000000000040E000-memory.dmp
memory/8276-8763-0x0000000000400000-0x000000000040E000-memory.dmp
memory/8436-8862-0x0000000000400000-0x0000000001FA9000-memory.dmp
memory/8436-8611-0x0000000000400000-0x0000000001FA9000-memory.dmp