Analysis
- user interaction
yes - max time kernel
1049s - max time network
1045s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/07/2026, 16:59
General
- Target https://mega.nz/file/CggwlbzK#TqgvUGijzlEyueRjaas9RqMk9kxO7sK4cc--JWyq5-M
- Sample260730-vhej7asfle
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 37 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object 2 TTPs 12 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Drops file in System32 directory 21 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 10 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 22 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 48 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 47 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/CggwlbzK#TqgvUGijzlEyueRjaas9RqMk9kxO7sK4cc--JWyq5-M1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffab3d7c728,0x7ffab3d7c734,0x7ffab3d7c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,727353924401516514,2081374668959350016,262144 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2012 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,1517385507414811287,6130943053276275981,524288 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,16624683326202112905,3887532064933022868,524288 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2388 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,7640734474229020798,8830010561655430176,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3188 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,4838978327960908691,8527557068817902659,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4408,i,8088375567376169817,9742779601883989906,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4436 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,1772890643865920450,18058196404560813961,524288 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,18306318557809872650,9529899610316443855,524288 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5668 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5856,i,454891483891737890,12912585433593179951,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6016,i,2002988006563440321,12662692555800043398,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,6454894577283388573,4924854168892585095,524288 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6236 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,628529344392073162,10319874055594731218,524288 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6280 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6228,i,5428106039153477912,16278374970821258160,524288 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6168 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6324,i,13708764755883765826,10033274186929214546,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6180 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=732,i,4090172366977136659,13551994228979762869,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4524 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6024,i,13567117071047385888,17850056992216359348,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3356,i,2023742743822885530,5275209272387824530,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4536,i,2574058060487787405,11764872732221321797,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6232,i,5860853273366443926,15163019130374953213,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3920,i,6705712878286487859,8318203731895554852,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5884 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6044,i,18411102558689852043,12591162839004741601,524288 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\jre-8u501-windows-i586.exe"C:\Users\Admin\Downloads\jre-8u501-windows-i586.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jds240750812.tmp\jre-8u501-windows-i586.exe"C:\Users\Admin\AppData\Local\Temp\jds240750812.tmp\jre-8u501-windows-i586.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Java\jre1.8.0_501\bin\javaw.exe-Djdk.disableLastUsageTracking -cp "C:\Program Files (x86)\Java\jre1.8.0_501\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserWebJavaStatus4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Java\jre1.8.0_501\bin\javaw.exe-Djdk.disableLastUsageTracking -cp "C:\Program Files (x86)\Java\jre1.8.0_501\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserPreviousDecisionsExist 304⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Java\jre1.8.0_501\bin\javaw.exe-Djdk.disableLastUsageTracking -cp "C:\Program Files (x86)\Java\jre1.8.0_501\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -systemConfig deployment.expiration.check.enabled false4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3208,i,4518799962734047499,9352293668279773348,262144 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6200 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,582521847928896673,4255735987284091301,524288 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4484 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\jre-8u501-windows-i586.exe"C:\Users\Admin\Downloads\jre-8u501-windows-i586.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jds240887203.tmp\jre-8u501-windows-i586.exe"C:\Users\Admin\AppData\Local\Temp\jds240887203.tmp\jre-8u501-windows-i586.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Java\jre1.8.0_501\bin\javaw.exe-Djdk.disableLastUsageTracking -cp "C:\Program Files (x86)\Java\jre1.8.0_501\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserWebJavaStatus4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Java\jre1.8.0_501\bin\javaw.exe-Djdk.disableLastUsageTracking -cp "C:\Program Files (x86)\Java\jre1.8.0_501\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserPreviousDecisionsExist 304⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6740,i,4890397264423475983,7229190715298053861,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6660 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7060,i,4047961425386201283,14633078075504519605,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7076 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7208,i,16846919982721344305,5832404981922965326,524288 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7204 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3316,i,2520319491671819755,5764070263295817149,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6928 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6716,i,5697335285274203365,14654247622810664717,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6640 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7380,i,15159980786545596782,11131027774777191401,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7308,i,5264207909340920108,13635291383514828144,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7320 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6944,i,6547257763895157160,12679783003182357172,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7316 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=4468,i,11658716811369768281,5156396542883363338,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6760 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7484,i,3423363790694806190,4614582042300086365,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7308,i,7975952605319374118,2037709199896767379,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7332 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6928,i,15681209559384724883,11170460945379417412,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7528 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7332,i,1914949701795030953,10007859754513920290,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7676 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7644,i,15521075522359085666,2511012627730122287,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7568,i,5694455807860255657,7775121604723299220,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7876 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7676,i,2450297227587241776,3096414185530630108,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6624 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7040,i,11141186587451506983,1174096122177093249,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6952 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7292,i,3314283885964915778,12512916860697957508,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7380,i,10596635629114166198,5824573104345716593,524288 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\jdk-26_windows-x64_bin.exe"C:\Users\Admin\Downloads\jdk-26_windows-x64_bin.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jds241079781.tmp\jdk-26_windows-x64_bin.exe"C:\Users\Admin\AppData\Local\Temp\jds241079781.tmp\jdk-26_windows-x64_bin.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7248,i,15792397042178998275,8476051678724244812,524288 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6880 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=7792,i,11126834908262685694,2848306186078505173,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7328 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=7604,i,9595508121452985028,11039123477453224073,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6968 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=5912,i,14991493111857045440,17806958703030069189,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5960 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7712,i,10011467316490623680,16992764098406145610,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7344 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=7732,i,14819065611260510120,4175675466911332238,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1520 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=6704,i,16660175147594646380,7776235695393266481,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6888 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=6696,i,9612874855927017874,11718954015240298026,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4504,i,8349231094278448093,14883922536755427835,524288 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7032 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=6928,i,2353586024984088798,14735634552231428655,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7716 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=3308,i,11332032631279667168,10786356320718110544,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7804 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=7824,i,18262302312532582076,2211818682503536226,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4552 /prefetch:12⤵
-
-
C:\Users\Admin\Downloads\jdk-26_windows-x64_bin.exe"C:\Users\Admin\Downloads\jdk-26_windows-x64_bin.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jds241288640.tmp\jdk-26_windows-x64_bin.exe"C:\Users\Admin\AppData\Local\Temp\jds241288640.tmp\jdk-26_windows-x64_bin.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk26.0.2_x64\jdk26.0.264.msi" WRAPPER=14⤵
- Enumerates connected drives
- Checks processor information in registry
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=5784,i,12959136377876112827,6201351528772910399,2097152 --field-trial-handle=2016,i,10840541618519513929,11247436712653415845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7652 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 77809ECF8C40BCB1383E562A0CA632B02⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Java\jre1.8.0_501\installer.exe"C:\Program Files (x86)\Java\jre1.8.0_501\installer.exe" /s INSTALLDIR="C:\Program Files (x86)\Java\jre1.8.0_501\\" WEB_ANALYTICS=Disable EULA=Disable INSTALL_SILENT=1 AUTO_UPDATE=Disable SPONSORS=Disable REPAIRMODE=0 ProductCode={77824AE4-039E-4CA4-87B4-2F32180501F0} TMPPINGFILE=C:\Users\Admin\AppData\Local\Temp\jdsping240751281.tmp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Java\jre1.8.0_501\bin\javaw.exe"C:\Program Files (x86)\Java\jre1.8.0_501\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Java\jre1.8.0_501\bin\ssvagent.exe"C:\Program Files (x86)\Java\jre1.8.0_501\bin\ssvagent.exe" -doHKCUSSVSetup3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\Java\jre1.8.0_501\bin\javaws.exe"C:\Program Files (x86)\Java\jre1.8.0_501\bin\javaws.exe" -wait -fix -permissions -silent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Java\jre1.8.0_501\bin\jp2launcher.exe"C:\Program Files (x86)\Java\jre1.8.0_501\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_501" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNTAxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNTAxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzUwMVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF81MDFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzUwMVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNTAxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNTAxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Java\jre1.8.0_501\bin\javaws.exe"C:\Program Files (x86)\Java\jre1.8.0_501\bin\javaws.exe" -wait -fix -shortcut -silent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Java\jre1.8.0_501\bin\jp2launcher.exe"C:\Program Files (x86)\Java\jre1.8.0_501\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_501" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNTAxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNTAxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzUwMVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF81MDFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzUwMVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNTAxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNTAxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6E31ED017C34E493366AF8B8C2837B6E E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding CCD20576738792AD54625CDCA136F41B2⤵
- Drops file in Program Files directory
-
-
C:\Windows\Installer\MSI27E4.tmp"C:\Windows\Installer\MSI27E4.tmp" INSTALLDIR="C:\Program Files\Java\jre-1.8\\" ProductCode={77924AE4-039E-4CA4-87B4-2F64180381F0} /s2⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\Java\jre1.8.0_501\bin\wsdetect.dll"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe"C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -u auto-update3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 348C7B14CD3A466449BCB2E5DC2E5910 E Global\MSI00002⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B50E6A2664359BA1495624E9C43495B32⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E65918ABC6A8F94F6A0226704F433EB1 E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 378F190D31E3B28CADBE5ADBEE10F3322⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 12440B68BE662DC729BD3194C38F19AF E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Installer\MSIAC3E.tmp"C:\Windows\Installer\MSIAC3E.tmp" INSTALLDIR="C:\Program Files (x86)\Java\jre1.8.0_501\\" ProductCode={77824AE4-039E-4CA4-87B4-2F32180501F0} /s2⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe"C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -u auto-update3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe" /x {4A03706F-666A-4037-7777-5F2748764D10} /qn4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B40108CFE2A7DF0F3FF9E331ED22046D E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5DC32D76ECC5FC60033950B3A4C8A00C2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 45D1AA466427E1EDCFDC34CD1F8ABAE9 E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B33F8C84F76EC75609684BBA012AE9B42⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Java\jre1.8.0_501\installer.exe"C:\Program Files (x86)\Java\jre1.8.0_501\installer.exe" /s INSTALLDIR="C:\Program Files (x86)\Java\jre1.8.0_501\\" INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={77824AE4-039E-4CA4-87B4-2F32180501F0} TMPPINGFILE=C:\Users\Admin\AppData\Local\Temp\jdsping240887437.tmp2⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Program Files (x86)\Java\jre1.8.0_501\bin\javaw.exe"C:\Program Files (x86)\Java\jre1.8.0_501\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Java\jre1.8.0_501\bin\ssvagent.exe"C:\Program Files (x86)\Java\jre1.8.0_501\bin\ssvagent.exe" -doHKCUSSVSetup3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\Java\jre1.8.0_501\bin\javaws.exe"C:\Program Files (x86)\Java\jre1.8.0_501\bin\javaws.exe" -wait -fix -permissions -silent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Java\jre1.8.0_501\bin\jp2launcher.exe"C:\Program Files (x86)\Java\jre1.8.0_501\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_501" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNTAxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNTAxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzUwMVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF81MDFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzUwMVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNTAxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNTAxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Java\jre1.8.0_501\bin\javaws.exe"C:\Program Files (x86)\Java\jre1.8.0_501\bin\javaws.exe" -wait -fix -shortcut -silent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Java\jre1.8.0_501\bin\jp2launcher.exe"C:\Program Files (x86)\Java\jre1.8.0_501\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_501" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNTAxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNTAxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzUwMVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF81MDFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzUwMVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNTAxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNTAxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7536EA4655C43F6EF9C0D353B0856769 E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A2F5162238C508BA394011F8BF0AC9EA2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AD3E938C92551DBFCB22DBF10A18F6A9 E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding ABA31ABE9F3F5F3CC4548072D035A62B C2⤵
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 9E85EC96D4BD913B74F2DA42763276E82⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 33C0EC82BDDCECE738E71F76187BCBA4 E Global\MSI00002⤵
- Drops file in System32 directory
- Drops file in Program Files directory
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\zalupa.tar.gz"2⤵
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SelectResume.jpeg" /ForceBootstrapPaint3D1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\zalupa\run.bat" "1⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Desktop\zalupa\jdk\bin\java.exe"jdk/bin/java.exe" -noverify -Djava.library.path=".\natives;." -cp ".\libraries\*;.\crack.jar" net.minecraft.client.main.Main --username dodik --version crack --accessToken 0 --assetsDir assets --assetIndex 1.12 --licensekey looseone2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\zalupa\run.bat"1⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Desktop\zalupa\jdk\bin\java.exe"jdk/bin/java.exe" -noverify -Djava.library.path=".\natives;." -cp ".\libraries\*;.\crack.jar" net.minecraft.client.main.Main --username dodik --version crack --accessToken 0 --assetsDir assets --assetIndex 1.12 --licensekey looseone2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\zalupa\run.bat" "1⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Desktop\zalupa\jdk\bin\java.exe"jdk/bin/java.exe" -noverify -Djava.library.path=".\natives;." -cp ".\libraries\*;.\crack.jar" net.minecraft.client.main.Main --username dodik --version crack --accessToken 0 --assetsDir assets --assetIndex 1.12 --licensekey looseone2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\zalupa\run.bat" "1⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Desktop\zalupa\jdk\bin\java.exe"jdk/bin/java.exe" -noverify -Djava.library.path=".\natives;." -cp ".\libraries\*;.\crack.jar" net.minecraft.client.main.Main --username dodik --version crack --accessToken 0 --assetsDir assets --assetIndex 1.12 --licensekey looseone2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\zalupa\run.bat" "1⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Desktop\zalupa\jdk\bin\java.exe"jdk/bin/java.exe" -noverify -Djava.library.path=".\natives;." -cp ".\libraries\*;.\crack.jar" net.minecraft.client.main.Main --username dodik --version crack --accessToken 0 --assetsDir assets --assetIndex 1.12 --licensekey looseone2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\zalupa\run.bat" "1⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Desktop\zalupa\jdk\bin\java.exe"jdk/bin/java.exe" -noverify -Djava.library.path=".\natives;." -cp ".\libraries\*;.\crack.jar" net.minecraft.client.main.Main --username dodik --version crack --accessToken 0 --assetsDir assets --assetIndex 1.12 --licensekey looseone2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\zalupa\run.bat1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\zalupa\run.bat" "1⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Desktop\zalupa\jdk\bin\java.exe"jdk/bin/java.exe" -noverify -Djava.library.path=".\natives;." -cp ".\libraries\*;.\crack.jar" net.minecraft.client.main.Main --username dodik --version crack --accessToken 0 --assetsDir assets --assetIndex 1.12 --licensekey looseone2⤵
- Checks processor information in registry
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\zalupa\run.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\zalupa\run.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\zalupa\run.bat" "1⤵
- Executes a command shell one-liner
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
5System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e59ba02.rbs
e59ba06.rbs
e59bb27.rbs
e59bb2c.rbs
e59bb30.rbs
e59bc56.rbs
e59bc57.rbf
e59bc58.rbf
e59bc5d.rbs
e59bc62.rbs
e59bc65.rbs
javaw.exe
invalid32x32.gif
LICENSE
default_US_export.policy
sound.properties
siphash.md
mesa3d.md
psfont.properties.ja
blocked.certs
Reference Documentation.url
Reference Documentation.url
Get Help.url
Get Help.url
Visit Java.com.url
Visit Java.com.url
Java3BillDevices.png
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000030
f_000032
f_000038
f_00003a
f_00003c
f_00003d
f_00003e
f_00003f
f_000040
f_000041
f_000042
f_000043
f_000046
f_000047
f_000051
f_000060
f_000064
f_000065
f_000066
f_000067
f_000068
f_000069
f_00006a
f_00006e
f_00008f
912a1743381ce9a0_0
d15bcf76fb423d3c_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
00000000
MANIFEST-000001
CURRENT
000003.log
LOG
LOG
LOG
LOG
LOG
LOG
LOG
LOG
LOG
LOG.old
LOG.old
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
fa813c9ad67834ac_0
fa813c9ad67834ac_1
the-real-index
the-real-index~RFe5861e2.TMP
853ccb5903f054dd_0
b8a38070788c55cb_0
the-real-index
index.txt
index.txt~RFe5e4312.TMP
000003.log
LOG.old
Local State
Local State
Local State
Local State
Local State
Local State
Local State
host[1]
layout[1]
masthead_left[1]
rtutils[1]
common[1]
runtime[1]
l10n[1]
masthead_fill[1]
COPYRIGHT
LICENSE
villages_end.dat
JavaDeployReg.log
MSID9A8.tmp
jusched.log
jusched.log
jusched.log
java.exe
MSI3D14.tmp
MSI6168.tmp
MSI692D.tmp
MSIBE45.tmp
e59bb29.msi
WindowsAccessBridge-32.dll
memory/1276-1700-0x0000000000A70000-0x0000000000A71000-memory.dmp
memory/1276-1677-0x0000000000A70000-0x0000000000A71000-memory.dmp
memory/1832-2262-0x0000000002850000-0x0000000002851000-memory.dmp
memory/1964-4102-0x0000000002EB0000-0x0000000002EB1000-memory.dmp
memory/1964-4078-0x0000000002EB0000-0x0000000002EB1000-memory.dmp
memory/2084-1436-0x0000000000990000-0x0000000000991000-memory.dmp
memory/2140-265-0x0000015194260000-0x0000015194349000-memory.dmp
memory/2676-4168-0x0000000001270000-0x0000000001271000-memory.dmp
memory/2676-4173-0x0000000001270000-0x0000000001271000-memory.dmp
memory/2676-4159-0x0000000001270000-0x0000000001271000-memory.dmp
memory/2676-4177-0x0000000001270000-0x0000000001271000-memory.dmp
memory/2676-4181-0x0000000001270000-0x0000000001271000-memory.dmp
memory/2676-4152-0x0000000001270000-0x0000000001271000-memory.dmp
memory/2848-9411-0x000001E4CB300000-0x000001E4CB301000-memory.dmp
memory/2848-9406-0x000001E4CB1F0000-0x000001E4CB1F1000-memory.dmp
memory/2848-9399-0x000001E4BA5A0000-0x000001E4BA5B0000-memory.dmp
memory/2848-9396-0x000001E4BA570000-0x000001E4BA580000-memory.dmp
memory/2848-9414-0x000001E4CB310000-0x000001E4CB311000-memory.dmp
memory/2848-9413-0x000001E4CB310000-0x000001E4CB311000-memory.dmp
memory/2848-9412-0x000001E4CB300000-0x000001E4CB301000-memory.dmp
memory/2848-9410-0x000001E4CB270000-0x000001E4CB271000-memory.dmp
memory/2848-9408-0x000001E4CB270000-0x000001E4CB271000-memory.dmp
memory/2992-4392-0x0000000002270000-0x0000000002271000-memory.dmp
memory/3276-2495-0x0000000000B80000-0x0000000000B81000-memory.dmp
memory/3624-2295-0x0000000002200000-0x0000000002201000-memory.dmp
memory/4356-4359-0x0000000000B90000-0x0000000000B91000-memory.dmp
memory/4392-1766-0x00000000005F0000-0x00000000005F1000-memory.dmp
memory/4392-1758-0x00000000005F0000-0x00000000005F1000-memory.dmp
memory/4392-1743-0x00000000005F0000-0x00000000005F1000-memory.dmp
memory/4720-3623-0x0000000000A90000-0x0000000000A91000-memory.dmp
memory/4768-2532-0x0000010F8EE10000-0x0000010F8EE11000-memory.dmp
memory/4768-2533-0x0000010F8EE10000-0x0000010F8EE11000-memory.dmp
memory/4768-2527-0x0000010F8EE10000-0x0000010F8EE11000-memory.dmp
memory/4768-2531-0x0000010F8EE10000-0x0000010F8EE11000-memory.dmp
memory/4768-2530-0x0000010F8EE10000-0x0000010F8EE11000-memory.dmp
memory/4768-2529-0x0000010F8EE10000-0x0000010F8EE11000-memory.dmp
memory/4768-2528-0x0000010F8EE10000-0x0000010F8EE11000-memory.dmp
memory/4768-2523-0x0000010F8EE10000-0x0000010F8EE11000-memory.dmp
memory/4768-2522-0x0000010F8EE10000-0x0000010F8EE11000-memory.dmp
memory/4768-2521-0x0000010F8EE10000-0x0000010F8EE11000-memory.dmp
memory/5480-11323-0x0000000800000000-0x0000000800010000-memory.dmp