Analysis
- geolocation tags
- user interaction
yes - max time kernel
869s - max time network
799s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 11:18
General
- Target 24122024.rar
- Size 446KB
- Sample261014-nesjbafg79
- SHA256 b378d7f1fa1cffa05b55917225232224ff0b13a1d739feac017c7fe56f1b3adb
Score
10/10
Malware Config
Signatures
- Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
- Modifies firewall policy service 3 TTPs 2 IoCs
- Modifies security service 2 TTPs 1 IoCs
- Suspicious use of NtCreateProcessExOtherParentProcess 1 TTPs 2 IoCs
- Windows security bypass 2 TTPs 2 IoCs
- Downloads MZ/PE file 1 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 28 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Modifies Security services 2 TTPs 3 IoCs
Modifies the startup behavior of a security service.
- AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 4 IoCs
- UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 18 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Kills process with taskkill 1 IoCs
- Modifies Control Panel 21 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 16 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 13 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\24122024.rar"1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap24400:74:7zEvent75921⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam2⤵
-
-
C:\Users\Admin\Desktop\24122024\dControl.exe"C:\Users\Admin\Desktop\24122024\dControl.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\24122024\dControl.exeC:\Users\Admin\Desktop\24122024\dControl.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\24122024\dControl.exe"C:\Users\Admin\Desktop\24122024\dControl.exe" /TI3⤵
- Modifies security service
- Executes dropped EXE
- Modifies Security services
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\Desktop\24122024\dControl.exe"C:\Users\Admin\Desktop\24122024\dControl.exe" /EXP |4512|4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable4⤵
- Drops file in Windows directory
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender://Threatsettings4⤵
-
-
C:\Users\Admin\Desktop\24122024\dControl.exe"C:\Users\Admin\Desktop\24122024\dControl.exe" /EXP |4512|4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\24122024\ReadMe.txt1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Windows Defender\MsMpEng.exe"C:\Program Files\Windows Defender\MsMpEng.exe"1⤵
- Modifies Windows Defender TamperProtection settings
- Modifies firewall policy service
- Windows security bypass
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbem\mofcomp.exeC:\Windows\system32\wbem\mofcomp.exe "C:\Program Files\Windows Defender\ProtectionManagement.mof"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exeC:\Windows\system32\taskkill.exe /f /FI "MODULES eq protectionmanagement.dll" /IM WmiPrvSE.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exeC:\Windows\system32\wevtutil.exe uninstall-manifest C:\Windows\SystemTemp\2FB5420A-469B-E4D5-1F52-8010C0D80D70.man2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exeC:\Windows\system32\wevtutil.exe install-manifest C:\Windows\SystemTemp\2FB5420A-469B-E4D5-1F52-8010C0D80D70.man "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges2⤵
- Drops file in Windows directory
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" GetDeviceTicket -AccessKey DE6D8960-61FC-474C-B0D2-EF59C935DB652⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges2⤵
- Downloads MZ/PE file
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemTemp\052D3422-E2F7-4841-8A95-8429DE8DDC20MpCommU\mpam-fe.exe"C:\Windows\SystemTemp\052D3422-E2F7-4841-8A95-8429DE8DDC20MpCommU\mpam-fe.exe" /q WD3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemTemp\2E44C4F0-849F-4C35-A421-47419506051F\MpSigStub.exeC:\Windows\SystemTemp\2E44C4F0-849F-4C35-A421-47419506051F\MpSigStub.exe /stub 1.1.24010.2001 /payload 1.461.20.0 /program C:\Windows\SystemTemp\052D3422-E2F7-4841-8A95-8429DE8DDC20MpCommU\mpam-fe.exe /q WD4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\system32\wevtutil.exeC:\Windows\system32\wevtutil.exe uninstall-manifest C:\Windows\SystemTemp\48B1968C-8453-0A05-C85B-CED83194E23C.man2⤵
-
-
C:\Windows\system32\wevtutil.exeC:\Windows\system32\wevtutil.exe install-manifest C:\Windows\SystemTemp\48B1968C-8453-0A05-C85B-CED83194E23C.man "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll"2⤵
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" GetDeviceTicket -AccessKey CD602587-C589-6F29-8DA5-9CD5690657602⤵
- Drops file in Windows directory
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {3522D7AF-4617-4237-AAD8-5860231FC9BA} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {3522D7AF-4617-4237-AAD8-5860231FC9BA} -Embedding1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall reset2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {6CED0DAA-4CDE-49C9-BA3A-AE163DC3D7AF} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {6CED0DAA-4CDE-49C9-BA3A-AE163DC3D7AF} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {6CED0DAA-4CDE-49C9-BA3A-AE163DC3D7AF} -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff80de9c728,0x7ff80de9c734,0x7ff80de9c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1924,i,6012983809322922814,16966087304664469443,524288 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,12249569854361044719,1159418026263683359,262144 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=1860 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,1465752073718355452,3906851172782842400,524288 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,15553925045895199263,12070915082183710888,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,6857939429616189321,1395611377331674986,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4736,i,17767014576382164178,10554607606621470304,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4892,i,83694532754831031,13026623165747172352,524288 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,16179876500225936051,9957297302295050855,524288 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5432,i,3715151537795536565,2682279909511887775,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5480,i,9112239099301279608,16688534956082996335,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5648,i,7710785786336571674,877429721389597140,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5472,i,8519798820471120819,11092520493935769811,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5892,i,330437134252825391,13967976697431480826,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6196,i,2035536649564318951,5655406865797963395,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6348,i,4980055678105613005,5639607775791352489,524288 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5892,i,18210411494384112454,10555664372081335820,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6604,i,15310483650748152933,6479650559046979653,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,17753647901166674890,240234656397124052,524288 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,7726614595141983147,12542892493116560800,524288 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6148,i,3579055479572503193,10606249925771786078,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6068,i,15624816058710205014,9827942199417831926,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5784,i,14414084328226097734,10463767930225955495,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5480,i,11164371086660512511,8896602113355451428,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3600,i,5521387654377419503,8142019443281404170,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3308,i,3717191506141026302,9778007968490224515,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4704,i,12395230056242217936,18357062607316069329,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6112,i,4787594936982540458,3606446486622486629,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6496,i,11384127891254774970,11534850099625147665,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=2728,i,17133532631829211419,7133727618282117078,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3728,i,15803619794027446195,438727740847323529,524288 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3636,i,6077879189471392555,13634241375160195965,524288 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3612,i,4604489365663867174,9242896327752562727,524288 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6076,i,13677552910762320455,7898965505851232167,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=3520,i,16534818493907030022,3209054414132760431,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=3940,i,5975515882961243955,15405134030714762217,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=3684,i,8365943405745711935,2213970381686277260,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=1236 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3624,i,11590344641362956729,5174025405610332537,524288 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6532,i,5157323718032453164,18073438307784654692,2097152 --field-trial-handle=1864,i,13418626433078547757,9780372633147624544,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap28801:106:7zEvent239541⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\" -an -ai#7zMap31199:1668:7zEvent222661⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MalwareDatabase-master\modern\" -an -ai#7zMap1941:278:7zEvent257901⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MalwareDatabase-master\rogues\" -an -ai#7zMap27342:3994:7zEvent237291⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\*\" -spe -an -ai#7zMap1769:2380:7zEvent172731⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MalwareDatabase-master\ransomwares\" -an -ai#7zMap23086:2380:7zEvent38361⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MalwareDatabase-master\fakescanners\" -an -ai#7zMap15536:13100:7zEvent305011⤵
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\d85ac558d8f746c69dbe380a4904a514 /t 4232 /p 56841⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
C:\Windows\SYSTEM32\mountvol.exemountvol c:\ /d3⤵
-
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
C:\Users\Admin\AppData\Local\Temp\is-SEUN9.tmp\is-5K9FK.tmp"C:\Users\Admin\AppData\Local\Temp\is-SEUN9.tmp\is-5K9FK.tmp" /SL4 $A01EE "C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]" 232353 522243⤵
-
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
-
C:\Users\Admin\Desktop\Malwaevswindowsdefender\[email protected]
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4148 -ip 41481⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Impair Defenses
5Disable or Modify System Firewall
2Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
mpengine.dll
{80042394-0000-0000-277C-09EF4EC91DBD}
232667F75287CFAAD2FE84934A2138A9
232667F75287CFAAD2FE84934A2138A9
232667F75287CFAAD2FE84934A2138A9
27AD9C59-01C5-4FC3-8F83-63222009E068
27AD9C59-01C5-4FC3-8F83-63222009E068
mpenginedb.db
mpenginedb.db-wal
MPDeviceControl-20261014-122214.log
MPLog-20261014-122214.log
ntuser.pol
03542d0e-df97-4261-8d01-f277b11ae607.tmp
19a174df-c2f7-4781-9366-5ccf47c3db6e.tmp
4d7bbb72-4fa7-4292-bb21-c76605b31d29.tmp
6753e4c3-6c49-4ff1-bcd6-4ce5f17ae1e4.tmp
739c71ce-c754-4a18-b24b-bec533dac28c.tmp
84c12100-e972-4d2d-8fc1-a970761d0c91.tmp
8e253056-67b7-43f7-ad8b-89c3b4601dc3.tmp
settings.dat
3dc96af7-833c-4340-a803-ccf4fed2608e.tmp
43ee5c13-af3f-46d6-b845-1f28d70f53b0.tmp
5fefe564-e3a3-4f64-8a9f-21f646982ec7.tmp
98746df3-4fd9-41d2-8b61-79aa2c6a52ca.tmp
989b1455-e1d0-4e5f-8bfc-c86cf11088d3.tmp
f_000004
f_000006
f_000008
f_000009
f_00000b
f_000015
f_00003d
f_00004a
f_00004b
temp-index
temp-index
messages.json
craw_background.js
CURRENT
MANIFEST-000001
1bf8e5b2-7669-4480-b2cf-e9c996be11c5.tmp
740220e7-f104-44d3-b748-a98a5488921b.tmp
79c83fce-ef43-4efb-86b6-38d82f96ee72.tmp
9e5ed9c8-1096-4d94-b297-1705ca424b8e.tmp
ae52521a-90df-4567-b0b8-e88945be305e.tmp
ebe361bc-e6bb-4b9b-8b58-299f374eb787.tmp
temp-index
temp-index
temp-index
the-real-index
data_0
data_1
data_2
data_3
Network Persistent State
a9844bce-9ecc-457b-812c-3b2c73fb80d1.tmp
d9df7a97-72ee-484c-9dc4-9bff2f0de5e8.tmp
dc686632-60df-429e-8b39-f5aecf40b924.tmp
e7678bf5-846c-4fad-b0b9-16cad0b07873.tmp
e7ee6b6e-bca8-4d73-9f9d-3afd9ee50724.tmp
4rmw9t4h.tmp
8e88542d-a567-4145-bc45-e345fc186292.tmp
messages.json
ReadMe.txt
dControl.exe
dControl.ini
3eede3b1-b251-4391-97b6-c37801fb90bc.tmp
2989‮.zip
Ana.zip
registry.pol
gpt.ini
MpSigStub.exe
mpasdlta.vdm
mpavdlta.vdm
mpengine.dll
2FB5420A-469B-E4D5-1F52-8010C0D80D70.man
48B1968C-8453-0A05-C85B-CED83194E23C.man
MpCmdRun.log
MpCmdRun.log
aut57A2.tmp
aut57B3.tmp
aut57B4.tmp
memory/760-69-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/760-68-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/760-139-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/760-4664-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/760-89-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/760-67-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/944-10-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/944-29-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/1140-21294-0x00000000003F0000-0x00000000005E2000-memory.dmp
memory/1140-21296-0x0000000004E30000-0x0000000004ECC000-memory.dmp
memory/1140-21311-0x0000000005090000-0x0000000005122000-memory.dmp
memory/1304-21283-0x0000000000A80000-0x0000000000A8E000-memory.dmp
memory/2120-48-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2436-21310-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2944-21305-0x00000000001E0000-0x000000000088E000-memory.dmp
memory/4148-21284-0x0000000000400000-0x0000000000438000-memory.dmp
memory/4160-136-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4244-154-0x0000029F1EF80000-0x0000029F1EF84000-memory.dmp
memory/4244-164-0x0000029F20C40000-0x0000029F20C44000-memory.dmp
memory/4244-170-0x0000029F20D60000-0x0000029F20E26000-memory.dmp
memory/4244-171-0x0000029F001D0000-0x0000029F001D1000-memory.dmp
memory/4244-172-0x0000029F002E0000-0x0000029F002E1000-memory.dmp
memory/4244-173-0x0000029F00330000-0x0000029F00331000-memory.dmp
memory/4244-174-0x0000029F003C0000-0x0000029F003C1000-memory.dmp
memory/4244-175-0x0000029F004D0000-0x0000029F004D1000-memory.dmp
memory/4244-176-0x0000029F00560000-0x0000029F00561000-memory.dmp
memory/4244-177-0x0000029F006B0000-0x0000029F006B1000-memory.dmp
memory/4244-178-0x0000029F00700000-0x0000029F00701000-memory.dmp
memory/4244-179-0x0000029F00810000-0x0000029F00811000-memory.dmp
memory/4244-180-0x0000029F00FE0000-0x0000029F00FE1000-memory.dmp
memory/4244-181-0x0000029F00FF0000-0x0000029F00FF1000-memory.dmp
memory/4244-182-0x0000029F0BBC0000-0x0000029F0BBC1000-memory.dmp
memory/4244-183-0x0000029F1E140000-0x0000029F1E141000-memory.dmp
memory/4244-184-0x0000029F1E150000-0x0000029F1E151000-memory.dmp
memory/4244-185-0x0000029F1E160000-0x0000029F1E161000-memory.dmp
memory/4244-186-0x0000029F1E170000-0x0000029F1E171000-memory.dmp
memory/4244-187-0x0000029F1E180000-0x0000029F1E181000-memory.dmp
memory/4244-189-0x0000029F1E1A0000-0x0000029F1E1A1000-memory.dmp
memory/4244-190-0x0000029F1E1B0000-0x0000029F1E1B1000-memory.dmp
memory/4244-191-0x0000029F1E1C0000-0x0000029F1E1C1000-memory.dmp
memory/4244-192-0x0000029F1E1D0000-0x0000029F1E1D1000-memory.dmp
memory/4244-193-0x0000029F1E1E0000-0x0000029F1E1E1000-memory.dmp
memory/4244-194-0x0000029F1E1F0000-0x0000029F1E1F1000-memory.dmp
memory/4244-195-0x0000029F1E200000-0x0000029F1E201000-memory.dmp
memory/4244-196-0x0000029F1E210000-0x0000029F1E211000-memory.dmp
memory/4244-197-0x0000029F1E220000-0x0000029F1E221000-memory.dmp
memory/4244-198-0x0000029F1E230000-0x0000029F1E231000-memory.dmp
memory/4244-199-0x0000029F1E240000-0x0000029F1E241000-memory.dmp
memory/4244-188-0x0000029F1E190000-0x0000029F1E191000-memory.dmp
memory/4244-167-0x0000029F20C70000-0x0000029F20CE0000-memory.dmp
memory/4244-168-0x0000029F20CE0000-0x0000029F20D48000-memory.dmp
memory/4244-169-0x0000029F20D50000-0x0000029F20D51000-memory.dmp
memory/4244-161-0x0000029F1EFF0000-0x0000029F1EFF4000-memory.dmp
memory/4244-162-0x0000029F20C20000-0x0000029F20C24000-memory.dmp
memory/4244-143-0x0000029F00180000-0x0000029F00184000-memory.dmp
memory/4244-144-0x0000029F0BFD0000-0x0000029F0BFD4000-memory.dmp
memory/4244-141-0x0000029F20550000-0x0000029F20C20000-memory.dmp
memory/4244-142-0x0000029F1EF60000-0x0000029F1EF61000-memory.dmp
memory/4244-140-0x0000029F20000000-0x0000029F20547000-memory.dmp
memory/4244-159-0x0000029F1EFD0000-0x0000029F1EFD4000-memory.dmp
memory/4244-158-0x0000029F1EFC0000-0x0000029F1EFC4000-memory.dmp
memory/4244-157-0x0000029F1EFB0000-0x0000029F1EFB4000-memory.dmp
memory/4244-165-0x0000029F20C50000-0x0000029F20C54000-memory.dmp
memory/4244-156-0x0000029F1EFA0000-0x0000029F1EFA4000-memory.dmp
memory/4244-152-0x0000029F1EF50000-0x0000029F1EF54000-memory.dmp
memory/4244-150-0x0000029F1EF30000-0x0000029F1EF34000-memory.dmp
memory/4244-160-0x0000029F1EFE0000-0x0000029F1EFE4000-memory.dmp
memory/4244-151-0x0000029F1EF40000-0x0000029F1EF44000-memory.dmp
memory/4244-148-0x0000029F1E060000-0x0000029F1E064000-memory.dmp
memory/4244-146-0x0000029F0BFF0000-0x0000029F0BFF4000-memory.dmp
memory/4244-166-0x0000029F20C60000-0x0000029F20C64000-memory.dmp
memory/4244-163-0x0000029F20C30000-0x0000029F20C34000-memory.dmp
memory/4244-145-0x0000029F0BFE0000-0x0000029F0BFE4000-memory.dmp
memory/4244-147-0x0000029F18FF0000-0x0000029F18FF4000-memory.dmp
memory/4244-155-0x0000029F1EF90000-0x0000029F1EF94000-memory.dmp
memory/4244-149-0x0000029F1E070000-0x0000029F1E074000-memory.dmp
memory/4244-153-0x0000029F1EF70000-0x0000029F1EF74000-memory.dmp
memory/4856-88-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/6516-21285-0x0000000000400000-0x000000000057F000-memory.dmp
memory/6600-21300-0x0000000000E20000-0x0000000000EA2000-memory.dmp
memory/6600-21320-0x0000000005A50000-0x0000000005AA6000-memory.dmp
memory/6600-21319-0x0000000005890000-0x000000000589A000-memory.dmp
memory/6628-1143-0x0000027A75740000-0x0000027A75762000-memory.dmp
memory/6628-1148-0x0000027A75B50000-0x0000027A75B98000-memory.dmp
memory/6936-21298-0x0000000000080000-0x0000000000100000-memory.dmp
memory/6936-21306-0x0000000005220000-0x00000000057DA000-memory.dmp