Analysis
- user interaction
yes - max time kernel
901s - max time network
906s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 03:50
General
- Target https://gofile.io/d/d3uJ7l
- Sample260731-eec9ysvzft
Score
7/10
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 33 IoCs
- Loads dropped DLL 41 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- Probable phishing domain 1 TTPs 1 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 11 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 44 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 20 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/d3uJ7l1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff444c728,0x7ffff444c734,0x7ffff444c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,12363539991282942420,12694156770871520836,262144 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1488,i,13536743396994099541,3923011901648738677,524288 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2128,i,4866680113598256512,3362486251089642077,524288 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,2406460608796823884,3908789383237028213,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,5070019104089534661,2184175850176220262,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4712,i,12533202657518651238,2540673547205204325,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3284,i,17752262789148320043,4970746710581653527,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,15744992758366963171,6619751446271846624,524288 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5504,i,16884331620796701304,10393112132149575249,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5536,i,7099471595313779311,2223355997570766631,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5804,i,16478560276792351850,10531525036380720130,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5532,i,12535368209195656622,11361131912293275620,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5516,i,18379680105346938805,14382356250781256452,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5584,i,9914679844397773789,9585326989102081761,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6064,i,15059417230215241751,7392183780489082404,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5800,i,17446165192184919677,5594111281245907980,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6044,i,17909129283686943040,3440944175215260300,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,5690402488976467354,2199240314045058651,524288 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4944,i,4683745556788199350,10903710872680085249,524288 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4956,i,6290396266140906333,5214464675071841126,524288 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6060,i,17571486633809443216,11594307326982634344,262144 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,14854039123970380057,11775634178828902834,524288 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,2478677104788630192,5066084660766865456,524288 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6000,i,5646567112165277607,2027891331345287215,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6388,i,16986297214273358176,48255105827593942,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6648,i,13400983129530458369,8399097495403137132,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6816,i,16985853466194133478,3390761485221423238,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6392,i,6117955127087208515,1331672370034061287,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6428,i,16374952311837760201,3995142236939354923,524288 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,12752465286449875032,16432624815848800289,524288 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:142⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6024,i,16363260992881054311,7877495311832255684,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6396,i,3830551821134700398,8846523875832147681,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6492,i,12648678862901635342,6778942506889447153,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7164,i,15094507060947611040,3027026766330890055,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6120,i,8006369023525716799,6164910341308354471,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=5740,i,14701844502244102127,5242956877505480486,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6036,i,2663926068858464985,14103537476596809518,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=2552,i,5565625811390369008,1358959306078045430,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7388,i,3663853466489775000,11998789926842916060,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7568,i,4095429220765375243,4136571968086198637,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7796,i,8118260457741487644,12108237120455499265,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=8028,i,2018307551638216450,9109854106088634485,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=8000 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=8168,i,6776633450401747781,3470137148918091636,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=8180 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=8304,i,2040823065295238196,12294194179030133192,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=8332 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=8372,i,3653726344640594056,11176748400173163010,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=8468 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=8280,i,5481322512597099537,17121362931591495789,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=8160 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7588,i,16016168253336708904,1153153216323964759,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=8012,i,5123759217423988602,10844690734342135871,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=7896,i,17092441449780668788,15297001526579745677,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=7920 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=7384,i,960780650349667795,8036494768416103673,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=8440 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7612,i,18240062312858479034,12952766154156728811,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=8356 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=8648,i,17443987830870143584,840328915780521999,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=7960 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=7552,i,366746775214902751,4963466519856632423,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=7248,i,1544950903712028751,10642486376205615879,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=7112,i,13754206235500499214,16115505574418552324,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=5732,i,3068474571978718766,1962521083900632196,2097152 --field-trial-handle=2028,i,2706763779600114899,16918827495780129516,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\5cb1a168-386c-4a26-89bb-047682154ba7_Garten-of-Banban-8-AD-SteamRIP.com.rar.ba7\Read_Me_Instructions.txt1⤵
-
C:\Users\Admin\Downloads\Garten-of-Banban-8-AD-SteamRIP.com\Garten of Banban 8 Anti Devil\Garten of Banban 8.exe"C:\Users\Admin\Downloads\Garten-of-Banban-8-AD-SteamRIP.com\Garten of Banban 8 Anti Devil\Garten of Banban 8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Garten-of-Banban-8-AD-SteamRIP.com\Garten of Banban 8 Anti Devil\Engine\Extras\Redist\en-us\UEPrereqSetup_x64.exe"C:\Users\Admin\Downloads\Garten-of-Banban-8-AD-SteamRIP.com\Garten of Banban 8 Anti Devil\Engine\Extras\Redist\en-us\UEPrereqSetup_x64.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Garten-of-Banban-8-AD-SteamRIP.com\Garten of Banban 8 Anti Devil\Engine\Extras\Redist\en-us\UEPrereqSetup_x64.exe"C:\Users\Admin\Downloads\Garten-of-Banban-8-AD-SteamRIP.com\Garten of Banban 8 Anti Devil\Engine\Extras\Redist\en-us\UEPrereqSetup_x64.exe" -burn.unelevated BurnPipe.{9920C7C0-9DE2-4D67-8EC9-72ADA11D4EB0} {E4FEB3BC-7542-47AB-87A2-585BE75FD1DF} 26883⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Package Cache\C9B5B7969E499A4FD9E580EF4187322778E1936A\VC_redist.x86.exe"C:\ProgramData\Package Cache\C9B5B7969E499A4FD9E580EF4187322778E1936A\VC_redist.x86.exe" /quiet /norestart -burn.embedded BurnPipe.{61094215-DED1-44DE-BE7B-5B9C104B2E83} {AA52C040-124D-45CA-A96B-B7EE8B57AC82} 26883⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{F1F2095D-6C49-4D2D-8C49-75B19B93A327}\.cr\VC_redist.x86.exe"C:\Windows\Temp\{F1F2095D-6C49-4D2D-8C49-75B19B93A327}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\C9B5B7969E499A4FD9E580EF4187322778E1936A\VC_redist.x86.exe" -burn.filehandle.attached=592 -burn.filehandle.self=692 /quiet /norestart -burn.embedded BurnPipe.{61094215-DED1-44DE-BE7B-5B9C104B2E83} {AA52C040-124D-45CA-A96B-B7EE8B57AC82} 26884⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{DC56A569-D33D-45CB-8022-53EE2DA11D36}\.be\VC_redist.x86.exe"C:\Windows\Temp\{DC56A569-D33D-45CB-8022-53EE2DA11D36}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{405694E9-9286-4389-821F-6F5FD3145099} {4A539456-6ED6-4955-92D7-956DE8373F2D} 41765⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\ProgramData\Package Cache\C483F66C48BA83E99C764D957729789317B09C6B\VC_redist.x64.exe"C:\ProgramData\Package Cache\C483F66C48BA83E99C764D957729789317B09C6B\VC_redist.x64.exe" /quiet /norestart -burn.embedded BurnPipe.{3F290B3C-DB6D-47E5-AE58-1AECE4316E6C} {63BFA095-6FD6-44D1-91E4-9CAB3D8BEB91} 26883⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{AC8F86D7-E6A8-4D5B-9468-D22DD471C305}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{AC8F86D7-E6A8-4D5B-9468-D22DD471C305}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\C483F66C48BA83E99C764D957729789317B09C6B\VC_redist.x64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /quiet /norestart -burn.embedded BurnPipe.{3F290B3C-DB6D-47E5-AE58-1AECE4316E6C} {63BFA095-6FD6-44D1-91E4-9CAB3D8BEB91} 26884⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{9330C8AF-15CC-4DBE-BCD8-AC231F69AA67}\.be\VC_redist.x64.exe"C:\Windows\Temp\{9330C8AF-15CC-4DBE-BCD8-AC231F69AA67}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{6F785A1C-82D2-4625-9175-AF93252342E7} {E6C00B93-1324-4198-AAEA-6CDF8E311862} 4725⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
-
C:\Users\Admin\Downloads\Garten-of-Banban-8-AD-SteamRIP.com\Garten of Banban 8 Anti Devil\Clay_8\Binaries\Win64\Clay_8-Win64-Shipping.exe"C:\Users\Admin\Downloads\Garten-of-Banban-8-AD-SteamRIP.com\Garten of Banban 8 Anti Devil\Clay_8\Binaries\Win64\Clay_8-Win64-Shipping.exe" Clay_82⤵
- Loads dropped DLL
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\ProgramData\Package Cache\{b24cae82-bb64-4ad2-820a-dc2c4031c914}\UEPrereqSetup_x64.exe"C:\ProgramData\Package Cache\{b24cae82-bb64-4ad2-820a-dc2c4031c914}\UEPrereqSetup_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\UE_Prerequisites_(x64)_20260731045723.log" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{b24cae82-bb64-4ad2-820a-dc2c4031c914}\UEPrereqSetup_x64.exe"C:\ProgramData\Package Cache\{b24cae82-bb64-4ad2-820a-dc2c4031c914}\UEPrereqSetup_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\UE_Prerequisites_(x64)_20260731045723.log2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{b24cae82-bb64-4ad2-820a-dc2c4031c914}\UEPrereqSetup_x64.exe"C:\ProgramData\Package Cache\{b24cae82-bb64-4ad2-820a-dc2c4031c914}\UEPrereqSetup_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\UE_Prerequisites_(x64)_20260731045723.log -burn.unelevated BurnPipe.{F8CB5C5F-9044-4FA5-84AF-EB7BCBA34EDE} {A1261870-FBD4-475E-B307-9878DD64F667} 11603⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Package Cache\C9B5B7969E499A4FD9E580EF4187322778E1936A\VC_redist.x86.exe"C:\ProgramData\Package Cache\C9B5B7969E499A4FD9E580EF4187322778E1936A\VC_redist.x86.exe" /quiet /norestart -burn.embedded BurnPipe.{EE321624-835C-40D1-996A-107B9D9E8B13} {AC9A1B2F-09B3-4D4F-864C-19DCF8DC7807} 11603⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{20CCA5E6-A628-4468-8F4B-4E6E17C817C7}\.cr\VC_redist.x86.exe"C:\Windows\Temp\{20CCA5E6-A628-4468-8F4B-4E6E17C817C7}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\C9B5B7969E499A4FD9E580EF4187322778E1936A\VC_redist.x86.exe" -burn.filehandle.attached=740 -burn.filehandle.self=584 /quiet /norestart -burn.embedded BurnPipe.{EE321624-835C-40D1-996A-107B9D9E8B13} {AC9A1B2F-09B3-4D4F-864C-19DCF8DC7807} 11604⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{4AF841EA-FB39-4809-A25E-513B8EB7DB6D}\.be\VC_redist.x86.exe"C:\Windows\Temp\{4AF841EA-FB39-4809-A25E-513B8EB7DB6D}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{526829DE-9C93-4885-A0EA-A760B2E75690} {3B3435E7-2271-4A63-920E-3F8A47660DBF} 43925⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\ProgramData\Package Cache\C483F66C48BA83E99C764D957729789317B09C6B\VC_redist.x64.exe"C:\ProgramData\Package Cache\C483F66C48BA83E99C764D957729789317B09C6B\VC_redist.x64.exe" /quiet /norestart -burn.embedded BurnPipe.{9D1664D4-C74C-4374-B45B-BE9E8E9B44DE} {446154D4-131F-4807-955F-49BDEA8A281A} 11603⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{33CCFEB0-6B46-4C73-ADC9-32A790A4FA89}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{33CCFEB0-6B46-4C73-ADC9-32A790A4FA89}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\C483F66C48BA83E99C764D957729789317B09C6B\VC_redist.x64.exe" -burn.filehandle.attached=732 -burn.filehandle.self=588 /quiet /norestart -burn.embedded BurnPipe.{9D1664D4-C74C-4374-B45B-BE9E8E9B44DE} {446154D4-131F-4807-955F-49BDEA8A281A} 11604⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{82F22E35-21C5-4832-8845-41842F1A9AE5}\.be\VC_redist.x64.exe"C:\Windows\Temp\{82F22E35-21C5-4832-8845-41842F1A9AE5}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0067D0E6-9D6B-4B58-A11A-D2AE5AFC26C1} {CCAFBB2F-D5B7-4190-92B8-918482DC9D6F} 19005⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding CC75C6D975EC04EBB89545908B48E249 E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI8B07.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241208187 10 CustomAction!CustomAction.CustomActions.InstallDirectX3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSI8B07.tmp-\DXSetup.exe"C:\Windows\Installer\MSI8B07.tmp-\DXSetup.exe" /silent4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DX905D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX905D.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX905D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX905D.tmp\infinst.exe X3DAudio1_7_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX905D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX905D.tmp\infinst.exe D3DX9_43_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX905D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX905D.tmp\infinst.exe d3dx10_43_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX905D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX905D.tmp\infinst.exe d3dx11_43_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX905D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX905D.tmp\infinst.exe d3dcsx_43_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX905D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX905D.tmp\infinst.exe D3DCompiler_43_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX905D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX905D.tmp\infinst.exe XAudio2_7_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll5⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 9617EFBB8ABE81B8C9F48831D6DA9E28 E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSIAA2A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241216156 17 CustomAction!CustomAction.CustomActions.InstallDirectX3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\Installer\MSIAA2A.tmp-\DXSetup.exe"C:\Windows\Installer\MSIAA2A.tmp-\DXSetup.exe" /silent4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\DXABE4.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXABE4.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXABE4.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXABE4.tmp\infinst.exe X3DAudio1_7_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXABE4.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXABE4.tmp\infinst.exe D3DX9_43_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXABE4.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXABE4.tmp\infinst.exe d3dx10_43_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXABE4.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXABE4.tmp\infinst.exe d3dx11_43_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXABE4.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXABE4.tmp\infinst.exe d3dcsx_43_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXABE4.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXABE4.tmp\infinst.exe D3DCompiler_43_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXABE4.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXABE4.tmp\infinst.exe XAudio2_7_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll5⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
-
-
C:\Users\Admin\Downloads\Garten-of-Banban-8-AD-SteamRIP.com\Garten of Banban 8 Anti Devil\Garten of Banban 8.exe"C:\Users\Admin\Downloads\Garten-of-Banban-8-AD-SteamRIP.com\Garten of Banban 8 Anti Devil\Garten of Banban 8.exe"1⤵
- Loads dropped DLL
-
C:\Users\Admin\Downloads\Garten-of-Banban-8-AD-SteamRIP.com\Garten of Banban 8 Anti Devil\Clay_8\Binaries\Win64\Clay_8-Win64-Shipping.exe"C:\Users\Admin\Downloads\Garten-of-Banban-8-AD-SteamRIP.com\Garten of Banban 8 Anti Devil\Clay_8\Binaries\Win64\Clay_8-Win64-Shipping.exe" Clay_82⤵
- Loads dropped DLL
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
5System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e6022a4.rbs
e6022a9.rbs
e6022b6.rbs
e6022c5.rbs
e6022cc.rbs
e6022d8.rbs
e6022df.rbs
e6022ee.rbs
e6022f3.rbs
e6022f7.rbs
e6022f8.rbf
e6022f9.rbf
e6022fa.rbf
e6022fb.rbf
e6022fc.rbf
e6022fd.rbf
e6022fe.rbf
e6022ff.rbf
e602300.rbf
e602301.rbf
e602302.rbf
e602303.rbf
e602304.rbf
e602305.rbf
e602306.rbf
e602307.rbf
e602308.rbf
state.rsm
state.rsm
state.rsm
42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
66AE3BFDF94A732B262342AD2154B86E_9040490E275779DE86373A998E4711FB
42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
66AE3BFDF94A732B262342AD2154B86E_9040490E275779DE86373A998E4711FB
BookmarkMergedSurfaceOrdering
f_00001d
f_00003f
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
CURRENT
7844b3f9-8b84-46d4-9fa0-baeecca747ab.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
D3DCompiler_43.dll
FEB2010_X3DAudio_x64.inf
FEB2010_X3DAudio_x86.inf
JUN2010_D3DCompiler_43_x64.inf
JUN2010_D3DCompiler_43_x86.inf
JUN2010_XAudio_x64.inf
JUN2010_XAudio_x86.inf
JUN2010_d3dcsx_43_x64.inf
JUN2010_d3dcsx_43_x86.inf
JUN2010_d3dx10_43_x64.inf
JUN2010_d3dx10_43_x86.inf
JUN2010_d3dx11_43_x64.inf
JUN2010_d3dx11_43_x86.inf
JUN2010_d3dx9_43_x64.inf
JUN2010_d3dx9_43_x86.inf
X3DAudio1_7.dll
XAPOFX1_5.dll
XAudio2_7.dll
apr2007_xinput_x64.inf
apr2007_xinput_x86.inf
d3dcsx_43.dll
d3dx10_43.dll
d3dx11_43.dll
d3dx9_43.dll
dxdllreg_x86.inf
dxupdate.dll
dxupdate.inf
infinst.exe
xinput1_3.dll
D3DCompiler_43_x86.inf
X3DAudio1_7_x86.inf
XAudio2_7_x86.inf
d3dcsx_43_x86.inf
d3dx10_43_x86.inf
d3dx11_43_x86.inf
d3dx9_43_x86.inf
infinst.exe
infinst.exe
xinput1_3_x86.inf
dd_vcredist_amd64_20260731045818_000_vcRuntimeMinimum_x64.log
dd_vcredist_amd64_20260731045818_001_vcRuntimeAdditional_x64.log
dd_vcredist_x86_20260731045804_000_vcRuntimeMinimum_x86.log
dd_vcredist_x86_20260731045804_001_vcRuntimeAdditional_x86.log
Banner.bmp
LogoSide.png
wixstdba.dll
UEPrereqSetup_x64.exe
PrereqSetup
VisualStudioRedist_X64
VisualStudioRedist_X86
default.exc
DXSETUP.exe
CustomAction.config
CustomAction.dll
Microsoft.Deployment.WindowsInstaller.dll
DirectX.log
license.rtf
thm.wxl
thm.xml
cab2C04DDC374BD96EB5C8EB8208F2C7C92
cab5046A8AB272BF37297BB7928664C9503
vcRuntimeAdditional_x64
vcRuntimeMinimum_x64
VC_redist.x64.exe
logo.png
wixstdba.dll
cab54A5CABBE7274D8A22EB58060AAB7623
cabB3E1576D1FEFBB979E13B1A5379E0B16
vcRuntimeAdditional_x86
vcRuntimeMinimum_x86
VC_redist.x86.exe
memory/52-968-0x000002153F640000-0x000002153F670000-memory.dmp
memory/52-970-0x000002153F610000-0x000002153F616000-memory.dmp