Analysis
- user interaction
yes - max time kernel
2699s - max time network
2700s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
17/10/2026, 09:12
General
- Target http://go-xlr.com
- Sample261017-k575xaeb43
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 13 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 26 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Discovers running processes 1 TTPs 2 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Drops file in System32 directory 64 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Kills process with taskkill 5 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 64 IoCs
- Opens file in notepad (likely ransom note) 6 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 5 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://go-xlr.com1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffde9c3c728,0x7ffde9c3c734,0x7ffde9c3c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,15719387109592405362,4924710380554581731,524288 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2156 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,11255728875680492116,1612487050715869354,262144 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2124 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,13863885175225221102,13069099895521327968,524288 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2296 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,3582049567369008676,7035576756983042107,2097152 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3172 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,16098061090205877911,10101936616620790940,2097152 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3220 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4484,i,12921480388171843589,12557145941029286027,2097152 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4156 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,7244136063343127534,7693344474065595193,2097152 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4740 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,14277603353655385278,3280326528248499575,524288 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5480 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5756,i,8493354024028183423,15857895973128127803,2097152 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5760 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6196,i,14029147511591616267,8868711469417479089,524288 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6192 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,3817713679020019742,9723880990212503748,524288 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5492 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,373390471706757793,8638811851364217,524288 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5480 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6228,i,10643916018811198793,8938598371477596063,524288 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6040 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5316,i,9416692168328629461,14668731893345282308,2097152 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5288 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5860,i,17068822215652375304,5937003914899788475,2097152 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5824 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4160,i,15129679485446712286,15742984454695059607,524288 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5820 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,14260204319954276806,15001651323489160677,524288 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4156 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=732,i,6980427780489353528,515097677964325855,2097152 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4424 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5860,i,17305716656022925420,2503024596261036057,2097152 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5992 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,4784853454801938392,11056637983072658238,524288 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5880 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\SysAnalyzer_Setup.exe"C:\Users\Admin\Downloads\SysAnalyzer_Setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-6HK61.tmp\SysAnalyzer_Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-6HK61.tmp\SysAnalyzer_Setup.tmp" /SL5="$E004E,4049513,53248,C:\Users\Admin\Downloads\SysAnalyzer_Setup.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\spSubclass2.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\TABCTL32.OCX"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\vbDevKit.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\mscomctl.ocx"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSWINSCK.OCX"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\hexed.ocx"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\richtx32.ocx"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\libVT.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSINET.OCX"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5636,i,6760512748671145391,5356969811461564117,262144 --field-trial-handle=2128,i,11010759191442951915,17898268688594980338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5552 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\GoXLR\" -spe -an -ai#7zMap4941:72:7zEvent112331⤵
- Suspicious use of FindShellTrayWindow
-
C:\Sandsprite\SysAnalyzer\dirwatch_ui.exe"C:\Sandsprite\SysAnalyzer\dirwatch_ui.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\GoXLR\GoXLR-Setup.exe"C:\Users\Admin\Downloads\GoXLR\GoXLR-Setup.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\OutboundLauncher\jdk8u482-b08-jre\bin\javaw.exeC:\Users\Admin\AppData\Local\OutboundLauncher\jdk8u482-b08-jre\bin\javaw.exe -jar C:\Users\Admin\AppData\Local\OutboundLauncher\Minesweep.jar2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\OutboundLauncher\jdk8u482-b08-jre\bin\javaw.exeC:\Users\Admin\AppData\Local\OutboundLauncher\jdk8u482-b08-jre\bin\javaw.exe -Xmx320m -XX:+UseG1GC -Dspark.relaunch=true -Dspark.type=DEFAULT -cp C:\Users\Admin\AppData\Local\Microsoft\Windows\FileExplorer.jar dev.spark.Main3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\winver.exeC:\Windows\System32\winver.exe4⤵
-
-
C:\Windows\System32\computerdefaults.exeC:\Windows\System32\computerdefaults.exe4⤵
-
C:\Users\Admin\AppData\Local\OutboundLauncher\jdk8u482-b08-jre\bin\java.exe"C:\Users\Admin\AppData\Local\OutboundLauncher\jdk8u482-b08-jre\bin\java.exe" -Dspark.elevated=true -Dspark.type=DEFAULT -cp "C:\Users\Admin\AppData\Local\Microsoft\Windows\FileExplorer.jar" dev.spark.Main5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Delete /TN ExplorerStartup /F6⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /TN ExplorerStartup /TR ""C:\Users\Admin\AppData\Local\OutboundLauncher\jdk8u482-b08-jre\bin\javaw.exe" -Xmx320m -XX:+UseG1GC -cp "C:\Users\Admin\AppData\Local\Microsoft\Windows\FileExplorer.jar" dev.spark.Main -no-startup" /SC ONLOGON /RL HIGHEST /F /IT6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\GoXLR\GoXLR-Utility.exe"C:\Users\Admin\AppData\Local\GoXLR\GoXLR-Utility.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\OutboundLauncher\jdk8u482-b08-jre\bin\javaw.exeC:\Users\Admin\AppData\Local\OutboundLauncher\jdk8u482-b08-jre\bin\javaw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\analysis\.spark-jre-write-test2⤵
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\analysis\dirwatchlog.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\analysis\logs.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\analysis\settings.dat2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\analysis\logs.txt_272⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffddc95c728,0x7ffddc95c734,0x7ffddc95c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2040,i,3154354863654693355,7522460884149374044,524288 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2060 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,5722327050025814473,15311160288571641350,262144 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1964 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,4698691076897413637,5237946941889928261,524288 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2604 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,1680335909207609814,6788973527307303466,2097152 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,2077920184795381435,16496107715118245649,2097152 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3324 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4500,i,10773276511949304755,1143712266404187415,2097152 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4544 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,8361648064148652353,17047153278795844660,524288 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5392 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5632,i,12978438561450441280,7033053211229986335,2097152 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5440 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3512,i,2132341718655388906,17417411338203867117,2097152 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3640 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4496,i,7837041343090132675,4580600419055699222,2097152 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3612 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=3556,i,10022068076341961052,17790129518622696976,524288 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5880 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6212,i,8670929307019482258,8115826300382678088,524288 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5848 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,2102936989167698265,15376196274910759109,524288 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6200 /prefetch:82⤵
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\deobfuscator-gui.jar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,974202213533131944,13694931018920737496,524288 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6284 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6160,i,3472610267817832472,6075231242785068617,524288 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6176 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,13527742367018470579,9685817346771679712,524288 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6164 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6112,i,4466502967252243660,12087788821838860349,262144 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6068 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3140,i,6747368582794798358,5631160222212195245,524288 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4528 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5392,i,18248278212216569645,1680139500516313824,2097152 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4516 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5424,i,7400049412105574105,5401242672102129174,2097152 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5692 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4520,i,12743206322987129521,1449310024476765985,2097152 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6284 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3960,i,14376131311514139191,3730322300002620138,2097152 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6480 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=1448,i,14175897400590207538,5706652619669407628,2097152 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6424,i,17550891011137908453,11910806633640750324,2097152 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6084 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6680,i,13990196872910053602,8418046179839700437,2097152 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6740 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5420,i,15828302406077530442,3496048581504555218,2097152 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6744 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6412,i,6723028905984299462,10557151097244138449,524288 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6016 /prefetch:82⤵
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\recaf-launcher-gui-0.8.8.jar"2⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,11660795764255468215,7892501454024309387,524288 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5788 /prefetch:82⤵
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\recaf-launcher-gui-0.8.8.jar"2⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6892,i,467423752466143203,15454921103775780449,2097152 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4132 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6484,i,8612072628883912281,13725796168819824941,2097152 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5868 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6664,i,916427255820005137,9489499401789203026,2097152 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4660 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6200,i,10806816917686621539,17944693206808978088,2097152 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7096 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6848,i,9453515548653673500,11743932910853401282,524288 --field-trial-handle=2020,i,17642252943000250516,1135176596702378809,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6864 /prefetch:82⤵
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\zulu25.36.205-ca-jdk25.0.4.1-win_x64.msi"2⤵
- Badlisted process makes network request
- Enumerates connected drives
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\zulu25.36.205-ca-jdk25.0.4.1-win_x64.msi"2⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\analysis\logs.txt_282⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\analysis\thread-dump.txt1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\39ab16d6729941b99ea3bfa62276bf89 /t 3060 /p 60281⤵
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\deobfuscator-gui.jar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\bd5478600c8a4cd4abd0fd8bd7909ac1 /t 2332 /p 38921⤵
-
C:\Sandsprite\SysAnalyzer\sysAnalyzer.exe"C:\Sandsprite\SysAnalyzer\sysAnalyzer.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Sandsprite\SysAnalyzer\api_logger.exe"C:\Sandsprite\SysAnalyzer\api_logger.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Sandsprite\SysAnalyzer\sniff_hit.exe"C:\Sandsprite\SysAnalyzer\sniff_hit.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Downloads\GoXLR\GoXLR-Setup.exe"C:\Users\Admin\Downloads\GoXLR\GoXLR-Setup.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\OutboundLauncher\jdk8u482-b08-jre\bin\javaw.exeC:\Users\Admin\AppData\Local\OutboundLauncher\jdk8u482-b08-jre\bin\javaw.exe -jar C:\Users\Admin\AppData\Local\OutboundLauncher\Minesweep.jar2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\GoXLR\GoXLR-Setup\" -spe -an -ai#7zMap24342:96:7zEvent257881⤵
-
C:\Sandsprite\SysAnalyzer\proc_watch.exe"C:\Sandsprite\SysAnalyzer\proc_watch.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Downloads\GoXLR\GoXLR-Setup.exe"C:\Users\Admin\Downloads\GoXLR\GoXLR-Setup.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\OutboundLauncher\jdk8u482-b08-jre\bin\javaw.exeC:\Users\Admin\AppData\Local\OutboundLauncher\jdk8u482-b08-jre\bin\javaw.exe -jar C:\Users\Admin\AppData\Local\OutboundLauncher\Minesweep.jar2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\deobfuscator-gui.jar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\WerFault.exe"C:\Windows\system32\WerFault.exe" -k -lc NDIS NDIS-20261017-1023.dmp1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FB22A64BC5ACB531BF29B8E642BDE02B2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DDF06504EB09DC3F2CAD44F530B8E2982⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Program Files\Zulu\zulu-25\bin\javaw.exe"C:\Program Files\Zulu\zulu-25\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\recaf-launcher-gui-0.8.8.jar"1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
C:\Program Files\Zulu\zulu-25\bin\java.exe"C:\Program Files\Zulu\zulu-25\bin\java.exe" -cp C:\Users\Admin\Downloads\recaf-launcher-gui-0.8.8.jar --enable-native-access=ALL-UNNAMED software.coley.recaf.launcher.ApplicationLauncher2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
-
-
C:\Program Files\Zulu\zulu-25\bin\javaw.exe"C:\Program Files\Zulu\zulu-25\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\recaf-4x-alpha-win-86-x64.jar"1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
-
C:\Program Files\Zulu\zulu-25\bin\javaw.exe"C:\Program Files\Zulu\zulu-25\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\recaf-launcher-gui-0.8.8.jar"1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
C:\Program Files\Zulu\zulu-25\bin\java.exe"C:\Program Files\Zulu\zulu-25\bin\java.exe" -cp C:\Users\Admin\Downloads\recaf-launcher-gui-0.8.8.jar --enable-native-access=ALL-UNNAMED software.coley.recaf.launcher.ApplicationLauncher2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
-
C:\Windows\system32\Taskmgr.exe"C:\Windows\system32\Taskmgr.exe"2⤵
-
-
C:\Windows\system32\tasklist.exe"C:\Windows\system32\tasklist.exe"2⤵
- Discovers running processes
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /IM javaw.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /IM javawexe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /IM java.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\tasklist.exe"C:\Windows\system32\tasklist.exe"2⤵
- Discovers running processes
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /IM java.exe /F2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /IM javaw.exe /F2⤵
- Kills process with taskkill
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultcc4fc4ach7aa1h4d1bh852eh3ff0fc50aa051⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultcc4fc4ach7aa1h4d1bh852eh3ff0fc50aa05 --edge-skip-compat-layer-relaunch2⤵
- Enumerates system info in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x230,0x7ffdcc05c188,0x7ffdcc05c194,0x7ffdcc05c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,11846245181788378744,7053498908593880246,262144 --field-trial-handle=1976,i,5872573678140210088,13430787423661594723,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,8932192725938234464,6061923119797005434,524288 --field-trial-handle=1976,i,5872573678140210088,13430787423661594723,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,8223262194481709123,3515343419424552708,524288 --field-trial-handle=1976,i,5872573678140210088,13430787423661594723,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:83⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Zulu\zulu-25\bin\javaw.exe"C:\Program Files\Zulu\zulu-25\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\recaf-launcher-gui-0.8.8.jar"1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
C:\Program Files\Zulu\zulu-25\bin\java.exe"C:\Program Files\Zulu\zulu-25\bin\java.exe" -cp C:\Users\Admin\Downloads\recaf-launcher-gui-0.8.8.jar --enable-native-access=ALL-UNNAMED software.coley.recaf.launcher.ApplicationLauncher2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Zulu\zulu-25\bin\javaw.exe"C:\Program Files\Zulu\zulu-25\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\recaf-4x-alpha-win-86-x64.jar"1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
-
C:\Program Files\Zulu\zulu-25\bin\javaw.exe"C:\Program Files\Zulu\zulu-25\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\recaf-4x-alpha-win-86-x64.jar"1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\hs_err_pid5408.log1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
7System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e65ebe3.rbs
e65ebe5.rbs
msvcp140.dll
vcruntime140.dll
vcruntime140_1.dll
sound.properties
jdk.xml
ASSEMBLY_EXCEPTION
ADDITIONAL_LICENSE_INFO
LICENSE
psfont.properties.ja
SysAnalyzer_help.chm
api_logger.exe
dir_watch.dll
dirwatch_ui.exe
proc_watch.exe
sniff_hit.exe
sysAnalyzer.exe
unins000.exe
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
glass.dll
javafx_font.dll
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
prism_d3d.dll
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
GoXLR-Utility.exe
05c2da96-601e-4b10-b298-392f76eee288.tmp
31b0e855-9a7d-4c09-a809-dbd64f5be0e4.tmp
458e9600-24f4-4fe7-9592-dadd1dd754d2.tmp
4a7af14e-ecd8-4502-877a-aca47c2c0795.tmp
6825d34d-2989-48e7-8bae-70de39e59aeb.tmp
7b9b0def-a4f4-4322-8d91-14b1aa9ea250.tmp
866e233b-4998-461d-82d2-c225c98d0d39.tmp
90999357-d756-4526-be4a-fa03f2d8de09.tmp
97159a62-aa7f-4b90-9358-e4974951fa62.tmp
9db75db9-412c-4ca5-ae49-bf44c75651d4.tmp
settings.dat
02b8fa99-ce3b-40ba-bd3d-900dd1ce1dd8.tmp
1cfb5ca9-fc29-4866-bf47-bc683c6b3726.tmp
2efca709-44d7-4786-ad92-4719cca827cf.tmp
32670e7a-cf9e-447c-81f5-5d1461bd8170.tmp
3b58bee2-81b4-4525-abfc-985158b95f14.tmp
459b4902-ce98-44cc-b990-a24f48253235.tmp
4dcc5f46-6eb1-4acb-9105-39b15a235299.tmp
4fcdc582-c55c-4bbe-a8cc-8e4550c9cc86.tmp
59e2f5cb-8113-41bc-a886-885f08c633c7.tmp
5b045724-4759-45ad-af69-f25107c5597f.tmp
67a4a7fb-9b5a-49cd-9506-6c6380fe4f1c.tmp
6d07ff17-af65-4af3-9aea-7de86b510b78.tmp
6f9a7b57-6b72-4317-a70d-77c63128d6db.tmp
6fe28c68-dba1-46d6-ad61-97d81fd61b77.tmp
735750db-3eba-4b15-8edd-1b52bfd7dab7.tmp
74fdc9f5-0cd7-4af5-a12d-0d83c6bc8c40.tmp
7c9800c7-3399-49df-bf40-881ebdb2e3ca.tmp
9755781d-d16b-4dcb-8f97-406e9acd2a3b.tmp
f_000011
f_00001e
f_000022
f_000031
f_000038
f_00003e
f_00003f
f_000040
f_000041
f_000042
f_000043
f_000044
f_000045
f_000046
f_000047
f_000048
f_000049
f_00004a
f_00004b
f_00004c
f_00004d
f_00004e
f_00004f
f_000050
f_000051
f_000052
f_000053
f_000054
f_000055
f_000056
f_000057
f_000058
f_000059
f_00005a
f_00005e
f_000073
f_000084
temp-index
temp-index
temp-index
temp-index
temp-index
temp-index
data_1
000003.log
CURRENT
LOG
MANIFEST-000001
04dc28f0-6330-47a2-bf23-172bd76bf790.tmp
0f2a1363-a89f-444f-b51e-fa4dca36cb2a.tmp
20791c9c-6062-427d-a98f-439c8fe8ff4c.tmp
25c18f5c-033a-4c70-b35d-a653973523e3.tmp
26bdab2d-3f55-4ef2-8e9d-37943401233f.tmp
292bae5b-6a08-4266-9586-678820ed1b8b.tmp
2b53cbec-5ebd-4a0a-87e1-fbfff4cc200f.tmp
2cc8d3d5-5864-4a74-8313-f240bbc9199e.tmp
311c337e-dd4c-47af-946f-5dd60aeb6e88.tmp
392a0905-88a7-40f8-be85-4f7bb4070742.tmp
a396f41c-92e8-4f05-9cdb-75c898d0376f.tmp
a5e79eaa-caae-4000-91af-5409ea940dac.tmp
b517fdd3-5b41-4f75-9573-3e7f61c14859.tmp
b6f1d428-ec4e-43e7-9bdb-ad7a528a2e47.tmp
c688c204-0d3a-4804-a13b-e8665f52ba45.tmp
ede044b0-db03-4c20-a0bc-dbd0b96d226c.tmp
fed1fc00-031a-474d-9451-dd82570eac2d.tmp
temp-index
the-real-index
temp-index
afc778d3-73c2-4156-aa51-b19e2e6be349.tmp
b1208bab-12a8-424e-a43d-b7f71d033bbf.tmp
cb6106ab-db50-4481-a240-6abe9969772e.tmp
d5d47f10-7706-43e3-8aa7-5bfbcb2f55f3.tmp
f9cee862-53c4-4ac5-99dd-f9897b27c7de.tmp
Local State
b52d9445-9417-4bdf-a1b5-65c04efad50b.tmp
b55bb08b-0578-4dbd-840e-efeacab5bfcf.tmp
d3abed97-2540-420c-8026-af9dd0d0e8b9.tmp
ddf509dc-8a16-4e3e-b22f-7fd0afe5dc32.tmp
ea2d35cd-4752-45a1-8c5d-24de8cbd306b.tmp
settings.dat
settings.dat
41efca50-813d-46e3-bb48-90e6f001b2f3.tmp
bac5d57f-3be8-464d-8af1-4d4128effdb9.tmp
Secure Preferences
d9e70286-e1db-4499-9a5a-15def03ab43c.tmp
ba9495f1-cbfd-414f-8cc2-47953fc3fb91.tmp
f911e7f9-db2e-41f2-b19f-4ce1aaa15f78.tmp
FileExplorer.jar
javaw.exe
win32_CopyNoDrop32x32.gif
US_export_policy.jar
microsoft.windows[1].xml
fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
SettingsCache.txt.~tmp
+JXF11069339762915576370.tmp
+JXF15433032468160143634.tmp
+JXF1823724641540124717.tmp
+JXF5212922790752888681.tmp
+JXF714018564365347446.tmp
__PSScriptPolicyTest_1wzqbcvm.2wu.ps1
imageio390963266757379406.tmp
SysAnalyzer_Setup.tmp
System.dll
modern-wizard.bmp
nsDialogs.dll
sqlite-unknown-a4407d4f-3271-49a6-8a42-d0e4264e30cd-sqlitejdbc.dll
logs.txt
.spark-jre-write-test
LICENSE
WindowsAccessBridge-64.dll
accessibility.properties
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
fontmanager.dll
jna874971859382037832.dll_1
logs.txt_1
logs.txt_12
logs.txt_13
logs.txt_14
logs.txt_16
logs.txt_21
logs.txt_22
logs.txt_25
logs.txt_30
logs.txt_32
logs.txt_7
logs.txt_8
thread-dump.txt_2
zipfs.jar
0ca2ab46-3403-4400-8e2a-8184b0ea46d6.tmp
57a767b0-6299-453d-a744-440184e183a7.tmp
6ca47637-29c9-4fcb-bdbd-f27eb083924c.tmp
SysAnalyzer_Setup.exe
WebCacheLock.json
MSI7223.tmp
MSINET.OCX
MSWINSCK.OCX
TABCTL32.OCX
hexed.ocx
libVT.dll
mscomctl.ocx
richtx32.ocx
spSubclass2.dll
vbDevKit.dll
api-ms-win-core-fibers-l1-1-0.dll
jvm.dll
memory/1824-1423-0x00000140B34D0000-0x00000140B34D1000-memory.dmp
memory/1824-1428-0x00000140B34D0000-0x00000140B34D1000-memory.dmp
memory/1824-1316-0x00000140B34D0000-0x00000140B34D1000-memory.dmp
memory/1824-1294-0x00000140B34D0000-0x00000140B34D1000-memory.dmp
memory/2600-10088-0x000001D2E01A0000-0x000001D2E0216000-memory.dmp
memory/2600-10087-0x000001D2E00D0000-0x000001D2E0114000-memory.dmp
memory/2600-10079-0x000001D2DFC10000-0x000001D2DFC32000-memory.dmp
memory/2828-2028-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2031-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1735-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1758-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1674-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1794-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2070-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2104-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2105-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1619-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1801-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1834-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1839-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1841-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1851-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1854-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1870-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1880-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1899-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2106-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1923-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2107-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1931-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1934-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1940-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1951-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1963-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1973-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1972-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1968-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1969-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1975-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2032-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1746-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2027-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2022-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-1979-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2033-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2108-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2109-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2112-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2083-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2084-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2036-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2039-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2072-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2052-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2051-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2078-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/2828-2055-0x000001BEBBB20000-0x000001BEBBB21000-memory.dmp
memory/3232-1435-0x0000015103D30000-0x0000015103D31000-memory.dmp
memory/3232-1660-0x0000015103D30000-0x0000015103D31000-memory.dmp
memory/3232-1629-0x0000015103D30000-0x0000015103D31000-memory.dmp
memory/3232-1630-0x0000015103D30000-0x0000015103D31000-memory.dmp
memory/3232-1484-0x0000015103D30000-0x0000015103D31000-memory.dmp
memory/4440-418-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/4440-412-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/4440-702-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/4440-666-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/4884-2049-0x0000015D1B170000-0x0000015D1B171000-memory.dmp
memory/5308-569-0x0000000020000000-0x0000000020044000-memory.dmp
memory/5664-716-0x0000000003F50000-0x0000000003F5F000-memory.dmp
memory/5748-703-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5748-406-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5748-405-0x000000000040D000-0x000000000040E000-memory.dmp
memory/5748-699-0x0000000000400000-0x0000000000414000-memory.dmp