Analysis
- user interaction
yes - max time kernel
1331s - max time network
1334s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
27/10/2026, 11:14
General
- Target http://fkhfhtrt.gjvjdf
- Sample261027-nccebadv5q
Score
9/10
Malware Config
Signatures
- Contacts a large (36761) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 37 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 17 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 28 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 32 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 16 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 12 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 8 IoCs
- Suspicious behavior: AddClipboardFormatListener 5 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://fkhfhtrt.gjvjdf1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff89462c188,0x7ff89462c194,0x7ff89462c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,1259520843053727173,10654180189114213280,524288 --field-trial-handle=2264,i,10245310685357746928,14728357321113433616,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,14915063251310883112,5192526346366916889,262144 --field-trial-handle=2264,i,10245310685357746928,14728357321113433616,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,11669822736935581204,8439315847156208822,524288 --field-trial-handle=2264,i,10245310685357746928,14728357321113433616,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,15901646179324262115,6123111782929298583,2097152 --field-trial-handle=2264,i,10245310685357746928,14728357321113433616,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,16519983375131925511,6402398299852764254,2097152 --field-trial-handle=2264,i,10245310685357746928,14728357321113433616,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,17437355697281382744,12407973262040215654,2097152 --field-trial-handle=2264,i,10245310685357746928,14728357321113433616,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,9517238549837755702,11760970720432658278,2097152 --field-trial-handle=2264,i,10245310685357746928,14728357321113433616,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5028,i,7391418643014612908,12249722178310104586,2097152 --field-trial-handle=2264,i,10245310685357746928,14728357321113433616,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff893dec728,0x7ff893dec734,0x7ff893dec7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1804,i,11830234773497886196,6672087439427810260,262144 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2156 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1624,i,10934402017682798578,12671228432285518693,524288 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2324 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,16158788055493798058,8716087638315093485,524288 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2572 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,1026397400037094361,8493130109789568570,2097152 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3256 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,15636147093310493250,13574658892552351148,2097152 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3304 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4456,i,5935461976005601179,3647061301343752016,2097152 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4464 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4700,i,11852143929740225051,12427710748252593210,2097152 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4736 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,12683022929140244061,16951829464559919337,524288 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5460 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5456,i,11231471703331386384,2450753942063301823,2097152 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5704 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3452,i,13056662013739197610,17900706764047279472,2097152 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3436 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3420,i,7299796846363490866,10889175358164768600,2097152 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5796 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6000,i,17414037926660191704,13429767169774624295,2097152 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3392 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6580,i,10083506190147630442,9706208906276400586,2097152 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6832 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6696,i,12373876247800686522,11547580351367377176,524288 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5796 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\MediaGet.exe"C:\Users\Admin\Downloads\MediaGet.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\MediaGet2\mediaget.exe"C:\Users\Admin\MediaGet2\mediaget.exe" --installer3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\MediaGet2\mediaget_crashpad_handler.exeC:\Users\Admin\MediaGet2\mediaget_crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Local\Media Get LLC\MediaGet2\crashdumps" "--metrics-dir=C:\Users\Admin\AppData\Local\Media Get LLC\MediaGet2\crashdumps" "--attachment=C:/Users/Admin/AppData/Local/Media Get LLC/MediaGet2/crashdumps/logs/log" "--attachment=C:\Users\Admin\AppData\Local\Media Get LLC\MediaGet2\crashdumps\1e245fe1-0d15-4057-d86d-68bb8387eee6.run\__sentry-event" "--attachment=C:\Users\Admin\AppData\Local\Media Get LLC\MediaGet2\crashdumps\1e245fe1-0d15-4057-d86d-68bb8387eee6.run\__sentry-breadcrumb1" "--attachment=C:\Users\Admin\AppData\Local\Media Get LLC\MediaGet2\crashdumps\1e245fe1-0d15-4057-d86d-68bb8387eee6.run\__sentry-breadcrumb2" --initial-client-data=0x724,0x728,0x72c,0x700,0x730,0x6f2e7b7c,0x6f2e7b90,0x6f2e7ba04⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe"C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe" --type=utility --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --service-sandbox-type=network --application-name=MediaGet2 --webengine-schemes=qrc:sLV --mojo-platform-channel-handle=3068 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe"C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-gpu-compositing --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=3900 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe"C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-gpu-compositing --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=4432 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe"C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-gpu-compositing --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=4664 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe"C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-gpu-compositing --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=5004 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe"C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-gpu-compositing --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=5244 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Infatica-m\infatica-service-app.exeC:\Users\Admin\AppData\Local\Infatica-m\infatica-service-app.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://axavl.com/g/2iw2selhvza0da9c6251ee610cb449/4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://axavl.com/g/2iw2selhvza0da9c6251ee610cb449/5⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ff89462c188,0x7ff89462c194,0x7ff89462c1a06⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2068,i,16209561382251185907,355662935370418610,524288 --field-trial-handle=2132,i,17914262098019597704,1902762044342165352,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:36⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,14096616333572262099,3474630994577030104,262144 --field-trial-handle=2132,i,17914262098019597704,1902762044342165352,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,17975059992405995011,16432535990548755511,524288 --field-trial-handle=2132,i,17914262098019597704,1902762044342165352,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15905489807868502674,9101957399001396102,2097152 --field-trial-handle=2132,i,17914262098019597704,1902762044342165352,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,3212164188679922464,12325693344183141642,2097152 --field-trial-handle=2132,i,17914262098019597704,1902762044342165352,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,4991546078299411056,15312016704049310447,524288 --field-trial-handle=2132,i,17914262098019597704,1902762044342165352,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,8931595534373510024,15542307477488584696,524288 --field-trial-handle=2132,i,17914262098019597704,1902762044342165352,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5060,i,7709128234136629336,12391099767318158050,2097152 --field-trial-handle=2132,i,17914262098019597704,1902762044342165352,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,9808222758454265918,1177865846340447437,524288 --field-trial-handle=2132,i,17914262098019597704,1902762044342165352,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,12003059661691668493,4323081754144433865,524288 --field-trial-handle=2132,i,17914262098019597704,1902762044342165352,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window6⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff89462c188,0x7ff89462c194,0x7ff89462c1a07⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,1838140922032011888,13548753879103362719,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:37⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,7264462043520716713,10619740271881681518,262144 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:27⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,18323994915204282848,4721596879423657406,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,2615543003244128858,12559958961817842788,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,2615543003244128858,12559958961817842788,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,16933161398838854194,10186291828306313913,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,11021431261036196076,8199780267379335502,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,2243355935330882180,18094116875822050985,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,10772706069916913796,8163257432985024774,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,5704699995475743875,8535543643436007073,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,5924297277420546049,8223088585930848351,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,15633287065273692851,16190199161664641157,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,17217081421305535161,14232195293663683290,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,11218260779367602341,4631132280976930753,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,17834300184141211294,16674683630962286047,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,13429803879796508539,9802955474860066042,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,16707053009377245906,7154630875473465517,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4792,i,9114585613335980011,4508102111771603266,262144 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:87⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3996,i,16405902649796552242,9175425854538830499,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=784,i,8932471580794405840,11497191607853412956,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4136,i,16825297418576213021,5120260901894428562,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,16018476035811451812,2378888900676754002,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,8328473353534325963,13689887203345110752,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4064,i,12753451511315666465,14590981846105309694,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,5613436748923458400,5147788464106506110,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,8699690437934145395,4556420104027404369,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,12360974099179279773,17745236722983979138,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,7563371544208424316,9743407315883063960,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,17813129577533191457,16682671935237097380,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,17784550432425103196,1700296841646790762,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,2524101486354496605,4850710609137255469,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,9081076135421396392,12638496290411083076,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,6225581911556296478,1307234234382781440,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,18373534946675968207,4792165848297167999,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,4274538507190633750,350959721046348695,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,9762921706573929717,11965040197466414041,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,18003729564768319652,17532434752775327840,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,216680387274566916,7304117720027352808,524288 --field-trial-handle=2436,i,13400810849144278033,1052462818324494866,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:87⤵
-
-
-
-
-
C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe"C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-gpu-compositing --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=6372 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,2455358691004511560,2693575904000776479,524288 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3224 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6996,i,9924908588224075677,14381198314068287020,524288 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7076 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,8746069209610796455,9144606788014740144,524288 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7120 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5632,i,6781912626983034816,3490086725577721014,262144 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1184 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7144,i,17295772345357037446,10620538748629079040,524288 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7132 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6292,i,10879803874144119612,17485268006945644591,2097152 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4500 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6996,i,18191138344019354243,14143033585268542020,2097152 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4592 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7164,i,18441059766996205050,4271873700119895269,2097152 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7056 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6420,i,14358054349679313559,440985389128319569,2097152 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6452 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6876,i,5266421397523726948,461933144980472202,2097152 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4504 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4724,i,11623700823996488282,9623003146368232665,2097152 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7276 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4772,i,9759611576994543651,2340822370612864934,524288 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4820 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=7256,i,5947824646082137041,7262190904951248242,524288 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7300 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=6476,i,15016840263540424278,10428321233948203138,524288 --field-trial-handle=2160,i,5713904593644945727,3390843844684362922,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7216 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Users\Admin\MediaGet2\mediaget.exe"C:\Users\Admin\MediaGet2\mediaget.exe" --minimized1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Infatica-m\infatica-service-app.exe"C:\Users\Admin\AppData\Local\Infatica-m\infatica-service-app.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\MediaGet Downloads\Minecraft-1.19.exe"C:\Users\Admin\Downloads\MediaGet Downloads\Minecraft-1.19.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1908426 "__IRAFN:C:\Users\Admin\Downloads\MediaGet Downloads\Minecraft-1.19.exe" "__IRCT:3" "__IRTSS:22693301" "__IRSID:S-1-5-21-686476835-2493921010-524562731-1000"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\MediaGet Downloads\Minecraft.Dungeons.Update.v1.8.0.0.incl.DLC-CODEX\Our official website is IGG-GAMES.COM, other sites are fake.txt1⤵
-
C:\Users\Admin\Downloads\MediaGet Downloads\Minecraft 1.10\setup.exe"C:\Users\Admin\Downloads\MediaGet Downloads\Minecraft 1.10\setup.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Downloads\MediaGet.exeC:\Users\Admin\Downloads\MediaGet Downloads\Minecraft 1.10\dcheck.dll2⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\MediaGet2\mediaget.exe"C:\Users\Admin\MediaGet2\mediaget.exe" --installer3⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\MediaGet2\mediaget_crashpad_handler.exeC:\Users\Admin\MediaGet2\mediaget_crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Local\Media Get LLC\MediaGet2\crashdumps" "--metrics-dir=C:\Users\Admin\AppData\Local\Media Get LLC\MediaGet2\crashdumps" --url=https://o612922.ingest.sentry.io:443/api/5751793/minidump/?sentry_client=sentry.native/0.4.6&sentry_key=b129893601654617990d7dd2cb86abed "--attachment=C:/Users/Admin/AppData/Local/Media Get LLC/MediaGet2/crashdumps/logs/log" "--attachment=C:\Users\Admin\AppData\Local\Media Get LLC\MediaGet2\crashdumps\a9646fe5-00c0-4aa2-31cb-23bf6f6c7409.run\__sentry-event" "--attachment=C:\Users\Admin\AppData\Local\Media Get LLC\MediaGet2\crashdumps\a9646fe5-00c0-4aa2-31cb-23bf6f6c7409.run\__sentry-breadcrumb1" "--attachment=C:\Users\Admin\AppData\Local\Media Get LLC\MediaGet2\crashdumps\a9646fe5-00c0-4aa2-31cb-23bf6f6c7409.run\__sentry-breadcrumb2" --initial-client-data=0x698,0x69c,0x6a0,0x674,0x6a4,0x74607b7c,0x74607b90,0x74607ba04⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe"C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe" --type=utility --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --service-sandbox-type=network --application-name=MediaGet2 --webengine-schemes=qrc:sLV --mojo-platform-channel-handle=3480 /prefetch:84⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe"C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-gpu-compositing --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=4500 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe"C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-gpu-compositing --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=4788 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe"C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-gpu-compositing --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=4292 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe"C:\Users\Admin\MediaGet2\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-gpu-compositing --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=5688 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\Downloads\MediaGet.exeC:\Users\Admin\Downloads\MediaGet Downloads\Minecraft 1.10\resource.bin2⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\MediaGet2\mediaget.exe"C:\Users\Admin\MediaGet2\mediaget.exe" --installer3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\Downloads\MediaGet.exeC:\Users\Admin\Downloads\MediaGet Downloads\Minecraft 1.10\resource1.bin2⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\MediaGet2\mediaget.exe"C:\Users\Admin\MediaGet2\mediaget.exe" --installer3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
-
-
-
C:\Users\Admin\Downloads\MediaGet Downloads\minecraft 1.7.2\Minecraft.exe"C:\Users\Admin\Downloads\MediaGet Downloads\minecraft 1.7.2\Minecraft.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit.exe"C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit.exe"C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit\Minecraft.exe"C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit\Minecraft.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit\jre\jdk-17.0.1\launch4j-tmp\Minecraft.exe"C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit\jre\jdk-17.0.1\launch4j-tmp\Minecraft.exe" -jar "C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit\Minecraft.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit\jre\jdk-17.0.1\bin\javaw.exejre\jdk-17.0.1\bin\javaw.exe -Djava.net.preferIPv4Stack=true -Xmn128M -Xmx2048M -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Xss1M -Djava.library.path=.\versions\fabric-loader-0.12.11-1.18.1\natives -Dminecraft.launcher.brand=minecraft-launcher -Dminecraft.launcher.version=2.0.1003 -cp .\libraries\net\fabricmc\tiny-mappings-parser\0.3.0+build.17\tiny-mappings-parser-0.3.0+build.17.jar;.\libraries\net\fabricmc\sponge-mixin\0.10.7+mixin.0.8.4\sponge-mixin-0.10.7+mixin.0.8.4.jar;.\libraries\net\fabricmc\tiny-remapper\0.6.0\tiny-remapper-0.6.0.jar;.\libraries\net\fabricmc\access-widener\2.0.1\access-widener-2.0.1.jar;.\libraries\org\ow2\asm\asm\9.2\asm-9.2.jar;.\libraries\org\ow2\asm\asm-analysis\9.2\asm-analysis-9.2.jar;.\libraries\org\ow2\asm\asm-commons\9.2\asm-commons-9.2.jar;.\libraries\org\ow2\asm\asm-tree\9.2\asm-tree-9.2.jar;.\libraries\org\ow2\asm\asm-util\9.2\asm-util-9.2.jar;.\libraries\net\fabricmc\intermediary\1.18.1\intermediary-1.18.1.jar;.\libraries\net\fabricmc\fabric-loader\0.12.11\fabric-loader-0.12.11.jar;.\libraries\com\mojang\blocklist\1.0.6\blocklist-1.0.6.jar;.\libraries\org\tlauncher\patchy\2.1.6\patchy-2.1.6.jar;.\libraries\com\github\oshi\oshi-core\5.8.2\oshi-core-5.8.2.jar;.\libraries\net\java\dev\jna\jna\5.9.0\jna-5.9.0.jar;.\libraries\net\java\dev\jna\jna-platform\5.9.0\jna-platform-5.9.0.jar;.\libraries\org\slf4j\slf4j-api\1.8.0-beta4\slf4j-api-1.8.0-beta4.jar;.\libraries\org\apache\logging\log4j\log4j-slf4j18-impl\2.14.1\log4j-slf4j18-impl-2.14.1.jar;.\libraries\com\ibm\icu\icu4j\69.1\icu4j-69.1.jar;.\libraries\com\mojang\javabridge\1.2.24\javabridge-1.2.24.jar;.\libraries\net\sf\jopt-simple\jopt-simple\5.0.4\jopt-simple-5.0.4.jar;.\libraries\io\netty\netty-all\4.1.68.Final\netty-all-4.1.68.Final.jar;.\libraries\com\google\guava\failureaccess\1.0.1\failureaccess-1.0.1.jar;.\libraries\com\google\guava\guava\31.0.1-jre\guava-31.0.1-jre.jar;.\libraries\org\apache\commons\commons-lang3\3.12.0\commons-lang3-3.12.0.jar;.\libraries\commons-io\commons-io\2.11.0\commons-io-2.11.0.jar;.\libraries\commons-codec\commons-codec\1.15\commons-codec-1.15.jar;.\libraries\com\mojang\brigadier\1.0.18\brigadier-1.0.18.jar;.\libraries\com\mojang\datafixerupper\4.0.26\datafixerupper-4.0.26.jar;.\libraries\com\google\code\gson\gson\2.8.8\gson-2.8.8.jar;.\libraries\com\mojang\authlib\3.2.38\authlib-3.2.38.jar;.\libraries\org\apache\commons\commons-compress\1.21\commons-compress-1.21.jar;.\libraries\org\apache\httpcomponents\httpclient\4.5.13\httpclient-4.5.13.jar;.\libraries\commons-logging\commons-logging\1.2\commons-logging-1.2.jar;.\libraries\org\apache\httpcomponents\httpcore\4.4.14\httpcore-4.4.14.jar;.\libraries\it\unimi\dsi\fastutil\8.5.6\fastutil-8.5.6.jar;.\libraries\org\apache\logging\log4j\log4j-api\2.14.1\log4j-api-2.14.1.jar;.\libraries\org\apache\logging\log4j\log4j-core\2.14.1\log4j-core-2.14.1.jar;.\libraries\org\lwjgl\lwjgl\3.2.2\lwjgl-3.2.2.jar;.\libraries\org\lwjgl\lwjgl-jemalloc\3.2.2\lwjgl-jemalloc-3.2.2.jar;.\libraries\org\lwjgl\lwjgl-openal\3.2.2\lwjgl-openal-3.2.2.jar;.\libraries\org\lwjgl\lwjgl-opengl\3.2.2\lwjgl-opengl-3.2.2.jar;.\libraries\org\lwjgl\lwjgl-glfw\3.2.2\lwjgl-glfw-3.2.2.jar;.\libraries\org\lwjgl\lwjgl-stb\3.2.2\lwjgl-stb-3.2.2.jar;.\libraries\org\lwjgl\lwjgl-tinyfd\3.2.2\lwjgl-tinyfd-3.2.2.jar;.\libraries\com\mojang\text2speech\1.11.3\text2speech-1.11.3.jar;.\versions\fabric-loader-0.12.11-1.18.1\fabric-loader-0.12.11-1.18.1.jar -DFabricMcEmu=net.minecraft.client.main.Main -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1NewSizePercent=20 -XX:G1ReservePercent=20 -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=32M -Dfml.ignoreInvalidMinecraftCertificates=true -Dfml.ignorePatchDiscrepancies=true -Djava.net.preferIPv4Stack=true -Dminecraft.applet.TargetDirectory=. net.fabricmc.loader.impl.launch.knot.KnotClient --username 123 --version fabric-loader-0.12.11-1.18.1 --gameDir "C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit" --assetsDir .\assets --assetIndex 1.18 --uuid 00000000-0000-0000-0000-000000000000 --accessToken null --clientId ${clientid} --xuid ${auth_xuid} --userType mojang --versionType release --width 925 --height 5303⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Network Configuration Discovery: Internet Connection Discovery
- Checks processor information in registry
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit\options.txt1⤵
-
C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit\Minecraft.exe"C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit\Minecraft.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit\jre\jdk-17.0.1\launch4j-tmp\Minecraft.exe"C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit\jre\jdk-17.0.1\launch4j-tmp\Minecraft.exe" -jar "C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit\Minecraft.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit\jre\jdk-17.0.1\bin\javaw.exejre\jdk-17.0.1\bin\javaw.exe -Djava.net.preferIPv4Stack=true -Xmn128M -Xmx2048M -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Xss1M -Djava.library.path=.\versions\fabric-loader-0.12.11-1.18.1\natives -Dminecraft.launcher.brand=minecraft-launcher -Dminecraft.launcher.version=2.0.1003 -cp .\libraries\net\fabricmc\tiny-mappings-parser\0.3.0+build.17\tiny-mappings-parser-0.3.0+build.17.jar;.\libraries\net\fabricmc\sponge-mixin\0.10.7+mixin.0.8.4\sponge-mixin-0.10.7+mixin.0.8.4.jar;.\libraries\net\fabricmc\tiny-remapper\0.6.0\tiny-remapper-0.6.0.jar;.\libraries\net\fabricmc\access-widener\2.0.1\access-widener-2.0.1.jar;.\libraries\org\ow2\asm\asm\9.2\asm-9.2.jar;.\libraries\org\ow2\asm\asm-analysis\9.2\asm-analysis-9.2.jar;.\libraries\org\ow2\asm\asm-commons\9.2\asm-commons-9.2.jar;.\libraries\org\ow2\asm\asm-tree\9.2\asm-tree-9.2.jar;.\libraries\org\ow2\asm\asm-util\9.2\asm-util-9.2.jar;.\libraries\net\fabricmc\intermediary\1.18.1\intermediary-1.18.1.jar;.\libraries\net\fabricmc\fabric-loader\0.12.11\fabric-loader-0.12.11.jar;.\libraries\com\mojang\blocklist\1.0.6\blocklist-1.0.6.jar;.\libraries\org\tlauncher\patchy\2.1.6\patchy-2.1.6.jar;.\libraries\com\github\oshi\oshi-core\5.8.2\oshi-core-5.8.2.jar;.\libraries\net\java\dev\jna\jna\5.9.0\jna-5.9.0.jar;.\libraries\net\java\dev\jna\jna-platform\5.9.0\jna-platform-5.9.0.jar;.\libraries\org\slf4j\slf4j-api\1.8.0-beta4\slf4j-api-1.8.0-beta4.jar;.\libraries\org\apache\logging\log4j\log4j-slf4j18-impl\2.14.1\log4j-slf4j18-impl-2.14.1.jar;.\libraries\com\ibm\icu\icu4j\69.1\icu4j-69.1.jar;.\libraries\com\mojang\javabridge\1.2.24\javabridge-1.2.24.jar;.\libraries\net\sf\jopt-simple\jopt-simple\5.0.4\jopt-simple-5.0.4.jar;.\libraries\io\netty\netty-all\4.1.68.Final\netty-all-4.1.68.Final.jar;.\libraries\com\google\guava\failureaccess\1.0.1\failureaccess-1.0.1.jar;.\libraries\com\google\guava\guava\31.0.1-jre\guava-31.0.1-jre.jar;.\libraries\org\apache\commons\commons-lang3\3.12.0\commons-lang3-3.12.0.jar;.\libraries\commons-io\commons-io\2.11.0\commons-io-2.11.0.jar;.\libraries\commons-codec\commons-codec\1.15\commons-codec-1.15.jar;.\libraries\com\mojang\brigadier\1.0.18\brigadier-1.0.18.jar;.\libraries\com\mojang\datafixerupper\4.0.26\datafixerupper-4.0.26.jar;.\libraries\com\google\code\gson\gson\2.8.8\gson-2.8.8.jar;.\libraries\com\mojang\authlib\3.2.38\authlib-3.2.38.jar;.\libraries\org\apache\commons\commons-compress\1.21\commons-compress-1.21.jar;.\libraries\org\apache\httpcomponents\httpclient\4.5.13\httpclient-4.5.13.jar;.\libraries\commons-logging\commons-logging\1.2\commons-logging-1.2.jar;.\libraries\org\apache\httpcomponents\httpcore\4.4.14\httpcore-4.4.14.jar;.\libraries\it\unimi\dsi\fastutil\8.5.6\fastutil-8.5.6.jar;.\libraries\org\apache\logging\log4j\log4j-api\2.14.1\log4j-api-2.14.1.jar;.\libraries\org\apache\logging\log4j\log4j-core\2.14.1\log4j-core-2.14.1.jar;.\libraries\org\lwjgl\lwjgl\3.2.2\lwjgl-3.2.2.jar;.\libraries\org\lwjgl\lwjgl-jemalloc\3.2.2\lwjgl-jemalloc-3.2.2.jar;.\libraries\org\lwjgl\lwjgl-openal\3.2.2\lwjgl-openal-3.2.2.jar;.\libraries\org\lwjgl\lwjgl-opengl\3.2.2\lwjgl-opengl-3.2.2.jar;.\libraries\org\lwjgl\lwjgl-glfw\3.2.2\lwjgl-glfw-3.2.2.jar;.\libraries\org\lwjgl\lwjgl-stb\3.2.2\lwjgl-stb-3.2.2.jar;.\libraries\org\lwjgl\lwjgl-tinyfd\3.2.2\lwjgl-tinyfd-3.2.2.jar;.\libraries\com\mojang\text2speech\1.11.3\text2speech-1.11.3.jar;.\versions\fabric-loader-0.12.11-1.18.1\fabric-loader-0.12.11-1.18.1.jar -DFabricMcEmu=net.minecraft.client.main.Main -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1NewSizePercent=20 -XX:G1ReservePercent=20 -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=32M -Dfml.ignoreInvalidMinecraftCertificates=true -Dfml.ignorePatchDiscrepancies=true -Djava.net.preferIPv4Stack=true -Dminecraft.applet.TargetDirectory=. net.fabricmc.loader.impl.launch.knot.KnotClient --username asd123 --version fabric-loader-0.12.11-1.18.1 --gameDir "C:\Users\Admin\Downloads\MediaGet Downloads\minecraft-1.18.1.fabric.optifine.xaeros.rei.wthit" --assetsDir .\assets --assetIndex 1.18 --uuid 00000000-0000-0000-0000-000000000000 --accessToken null --clientId ${clientid} --xuid ${auth_xuid} --userType mojang --versionType release --width 925 --height 5303⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Network Configuration Discovery: Internet Connection Discovery
- Checks processor information in registry
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
2Peripheral Device Discovery
1Query Registry
6System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
5036cbdf-0209-42d2-b6fe-956c88a75619.tmp
7d88a733-8f18-4beb-9292-5497794f0ada.tmp
8d72de24-1350-4273-9457-f0ff06f41f92.tmp
settings.dat
6b00c066-cf0f-421d-9684-01b79b175835.tmp
80be0478-ed34-439c-afff-01b48cd06984.tmp
8a4809e9-7e24-4a49-8803-b98f5fa926d9.tmp
8e2a1150-07ce-49be-9669-65facbb72b85.tmp
f_000005
f_000007
f_000009
f_00000a
f_00000c
f_000011
f_00001a
f_00002e
f_000033
f_000034
f_000035
f_000037
f_000039
f_00003a
f_000043
f_000049
f_00004b
f_00004c
f_00004d
temp-index
temp-index
the-real-index
MANIFEST-000001
CURRENT
126eb6b9-9721-4d8c-9665-cbc123504555.tmp
1a3aef96-b46f-4a93-b7c5-f7e6b948866a.tmp
3395c939-3e3a-492f-98ec-2e26b22da8db.tmp
3e0fcc67-d7e4-4e1b-8205-58691d540e34.tmp
8b04ba62-ad19-4aa0-8c63-ece37e8793e1.tmp
8be6ce14-89d5-4875-b2c6-3b952a492ce2.tmp
98c080e9-e55c-406f-a2b7-ffeb310d972b.tmp
b251fed1-e9b5-4359-8b48-6c4b87260888.tmp
b6277f24-3ff9-4afc-b49c-d3d1a40d795e.tmp
c6f4e190-7bb2-4fd4-9cf1-1b39478f36db.tmp
fa813c9ad67834ac_0
fa813c9ad67834ac_1
temp-index
temp-index
the-real-index
temp-index
b850a593-eb06-4468-bfeb-cd409864c82d.tmp
c686ad8f-e878-4144-bf50-05786b843add.tmp
d3670f97-61c0-40b6-9232-03b7a0f8dbdb.tmp
eca98947-15e6-4e80-a437-8adf4dcd5cbc.tmp
fe6401db-b535-44b8-b67c-d59054c2de09.tmp
c41d7791-919a-4cd4-b900-4d73f9e72849.tmp
cf8903c9-b2a3-44f6-8209-1fdefced6d3a.tmp
dcb101d5-735c-48bc-b6f0-a741b344b66c.tmp
e034ff06-481c-4d81-8b1f-132fe46364d0.tmp
f1b71a0d-e89e-4d3d-9200-55ece705ac89.tmp
f4b93ebc-b88f-4f87-9403-872a32d43eb7.tmp
2c01d9ca463dee33c60e2dabd4bcc822b0153b50.ini
3fbde34d85a0711210c1c756360283449c8f5fa9.ini
3fbde34d85a0711210c1c756360283449c8f5fa9.ini
4d0943c0b5e82fd80cc442c719f1bdde3673add5.ini
4d0943c0b5e82fd80cc442c719f1bdde3673add5.ini
79f0d4ed12a9f8d8a01b2067d3abd4c593e7b80f.ini
79f0d4ed12a9f8d8a01b2067d3abd4c593e7b80f.ini
82743fc2c64a773debe656f3c9103b461b2d256f.ini
82743fc2c64a773debe656f3c9103b461b2d256f.ini
82743fc2c64a773debe656f3c9103b461b2d256f.ini.AZCvzY
a2507c698f4df114673c567589e2443561cb810b.ini
a2507c698f4df114673c567589e2443561cb810b.ini
a2507c698f4df114673c567589e2443561cb810b.ini.YfRVhq
a2507c698f4df114673c567589e2443561cb810b.ini.lock
adframes
afc931fcb4d42d1dd37d0d2a107355ef60b1a754.ini
afc931fcb4d42d1dd37d0d2a107355ef60b1a754.ini
afc931fcb4d42d1dd37d0d2a107355ef60b1a754.ini.lYkVcP
7b571252-9583-4961-8b0f-c812a813ca3a.tmp
data_0
data_2
data_3
bd67663a-52b1-470f-b5c6-33c182714852.tmp
cookies.ini.lock
cookies_search.ini
__sentry-event
__sentry-event
log
log
log
log
settings.dat
ed0098bfd8534b4d07b97ac3ee708c6f1d6b40b8.ini
ed0098bfd8534b4d07b97ac3ee708c6f1d6b40b8.ini
ed0098bfd8534b4d07b97ac3ee708c6f1d6b40b8.ini.pGNitq
f316980032c3150dfce31954e0b3ea89d6456003.ini
f316980032c3150dfce31954e0b3ea89d6456003.ini
f316980032c3150dfce31954e0b3ea89d6456003.ini.rUuaHs
fe144a508a39049b7379bdea69ff432591559d4a.ini
fe144a508a39049b7379bdea69ff432591559d4a.ini
history
history
history
history
history
history
history
history_play
loader.7z
style.css
index.html
poster.jpg
torrent.info
poster_133x200.jpg
poster.jpg
torrent.info
4d0943c0b5e82fd80cc442c719f1bdde3673add5.mediaget
ed0098bfd8534b4d07b97ac3ee708c6f1d6b40b8.mediaget
sigpk
search_stop_word
clicked_items
204.14.17.70
bitreactor.to
elitetorrent.net
fast-torrent.ru
fastpic.ru
firepic.org
hqclub.net
imageshack.us
kastatic.com
kat.ph
kickass.to
kickasstorrents.com
leetleech.org
lostpic.net
mgshare.com
nil
opentracker.pw
pictat.com
radikal.ru
rudb.org
turbopic.org
youpicture.org
1337x.to
elitetorrent.net
extratorrent.cc
fast-torrent.ru
maintracker.org
mediaget
mediaget-dht
mediaget.fast-torrent
mediaget.rutor
new-rutor.org
opentracker.pw
rarbg.to
rutor.info
rutracker.org
tfile.co
thepiratebay10.org
torrentproject.se
yourbittorrent.com
stop_words_urls
stop_words_urls
bittorrent_trackers
elitetorrent.net
fast-torrent.ru
maintracker.org
mediaget
mediaget.fast-torrent
mediaget.rutor
rutor.is
rutracker.org
tfile.co
139656f4-bc71-4fd7-a918-ad31a0129693.tmp
18113962-2477-47df-a47f-c150d81ac634.tmp
2094474c-8b53-491f-addc-498b9b2357fb.tmp
2834c07f-8e42-4c4a-b7c6-ff73a46edbc3.tmp
35ea0f8f-1b4a-41bf-8a83-83fa4eb6f732.tmp
45b84480-0630-4a66-9ef6-25b8f5ec51f0.tmp
56e316ae-8325-4ea5-ad3b-c7d958b5cca9.tmp
656f8a6d-0211-4d9c-81c4-81f3a3618ec8.tmp
662317e4-fc3e-45cf-a837-747e956f8ab6.tmp
6639e717-159e-4315-a0c9-3191d7afa3c0.tmp
7ba72aa6-e1f5-40a3-9b50-4101cfc4576e.tmp
807303af-5421-4ee8-987d-6aed4e8a8b6d.tmp
837d8630-b7cf-4d53-b244-2311084c3728.tmp
8c46d943-149a-4852-a327-8fc6d5cfed69.tmp
TransportSecurity
a19f33c0-9a9c-454b-a588-b99fa9ec1857.tmp
a644c7df-d5c4-4818-b1fb-73a0cdfaee5e.tmp
a8998577-2cf9-4161-880e-7d3e60e8d4e1.tmp
a9beb822-bb04-42be-afb9-ed4d2ddf25e6.tmp
aedc46ab-b7ce-4aca-9b65-dfa647116b0a.tmp
b471f415-94d2-4e1b-a647-12ea2a9e3bb1.tmp
b70d0a31-cab4-4399-9ad1-85d70923267d.tmp
dae5c7b5-7d01-4b5f-811c-279cfc2b6f0f.tmp
f0a2d6fc-38f8-41d2-87e8-e80d2e10cbde.tmp
f8fbf949-4705-4068-a105-3a9788b5587c.tmp
449667a3-9453-4521-8523-70adb10a9331.tmp
5997ed7f-afe4-4690-9f41-eaa76b8f7f8b.tmp
89155aea-35c6-4dd7-b2ad-32383d97f1ba.tmp
977514a6-1d3f-4da0-a5f1-78871da579e1.tmp
Network Persistent State
TransportSecurity
d6eac905-5d9a-45d5-8f25-fb7670b9eed4.tmp
02d5fd24-56a3-42d4-beac-fe3d9ad132a5.tmp
073f6219-58a9-4755-b9cb-51e8f0a35c92.tmp
1a856537-643d-4c69-8a54-5fa05326d049.tmp
4bc6f06b-d4f9-4928-aa0e-5c398bba6d69.tmp
511997bb-2beb-494a-8eb3-d7fecbd8fbaf.tmp
56cbb3aa-e8a6-4437-b73e-e04e1fe295f4.tmp
59b2618b-0374-473a-944b-d11f75d7c69d.tmp
85076b03-3ce8-4752-87af-368b6260527b.tmp
6260f3fc-1d65-4bdf-85a2-e6a9fde73409.tmp
settings.dat
settings.dat
settings.dat
settings.dat
1b761275-3102-4ca1-ab62-ca6be54209ca.tmp
244fc00b-8152-4206-8fe4-7e12cbec848c.tmp
2567f119-3cd8-4c2a-9677-5092b19f4a21.tmp
285a1eea-3adf-4de3-9417-2b362737919c.tmp
61df3703-5665-4c99-8a54-425351363ccd.tmp
69265fab-2544-454f-82e3-68000932b813.tmp
855b695d-1af1-4e1d-b104-4075c3f8553d.tmp
LOG.old
LOG.old
f_00008d
temp-index
temp-index
the-real-index
c59b17e3-f565-48df-aebe-e4616346c3f5.tmp
dasherSettingSchema.json
0de29cf6-8f13-489f-90d7-4c5c03d23dec.tmp
7040e025-8b4d-49aa-8dec-942e1db67b53.tmp
c714108a-9f1b-4a94-a104-37528935a131.tmp
e782a335-bb33-4fd9-ac64-f3a206471236.tmp
ffe39d48-3731-402b-ac57-449448f5002d.tmp
sync_diagnostic.log
dfcbc4a4-d224-4b49-b92d-72012807b2d1.tmp
fa64d686-7292-4b8c-bc5b-abc33828301c.tmp
73f24dd2-a5a3-448b-b9dd-dc9b650d4851.tmp
data_1
bade403c-7061-466a-bc7a-40706518db3a.tmp
0c2ee294-bc2b-4328-849a-5d4344477ab8.tmp
259398f4-73e7-4316-8c1d-700aea011a63.tmp
3fa5915d-055f-4ee7-b660-f5adced83541.tmp
4aa8922a-4bee-4243-beff-48cdea529a25.tmp
4f99bbe5-04f3-4b5f-99f0-2d915a64e6bb.tmp
4f9c4dcc-3933-4fe7-8283-a56f4b5e5529.tmp
53192f69-5abb-4af6-b741-133100340b8e.tmp
641a1449-35fa-4472-a221-ff0fa9393156.tmp
802f6ff0-64e3-41f7-a763-7b5c523b2926.tmp
8bb348d6-c5ba-4a9c-a5a6-da3b3bbd4717.tmp
94f2e815-1e55-4b99-aa3e-94e1fdcccb14.tmp
9ecf46b6-ae04-4481-abb6-2e2497c9a3ee.tmp
a73eb713-9f8c-4c90-8ed0-d99d03f69689.tmp
a795a1e0-3020-4890-89bc-ee82f68ed09b.tmp
cadf5da2-8b7a-4cda-ae95-c7f700dbf29a.tmp
e2106b25-5f4c-4bbf-9d99-a0dc967e4fa2.tmp
e4e0241f-fa55-4343-8e5c-aa04ad1c3239.tmp
d7be42c2-0f08-48d5-b5c3-9ea3c09279f4.tmp
0f271c70-79ae-42b3-ab37-2f110692c2e4.tmp
65cfcd1f-6938-4ccc-888a-9988e172b80f.tmp
9317d7ce-2bfd-4b78-905e-d9f976d1ca95.tmp
200.ico
IRZip.lmd
Wow64.lmd
irsetup.exe
Montserrat-Bold.eot
Montserrat-Regular.eot
Roboto-Regular.eot
VerdanaPro-Regular.eot
archive.7z
cancel-ru.template
cancel.template
av360-check-off.png
av360-check-on.png
av360.png
bundle1-check-off.png
bundle1-check-on.png
bundle2-check-off.png
bundle2-check-on.png
cancel-page-new1-ru.png
close-gray.png
close-lightgray-14px.png
close-white.png
coc.png
earnapp.png
install-lenta-2-308.png
install-lenta-3-308.png
install-lenta.png
main-logo-compact.png
main-logo-white.png
opera-check-off.png
opera-check-on.png
opera-empty.png
page-wait.png
point.png
radio-checked.png
radio-unchecked.png
settings-checked.png
settings-unchecked.png
soax-mglogo.png
soax-schema.png
wps-en.jpg
wps-ru.jpg
wps.jpg
yandex-logo.png
index.html
install-min.template
page-wait.jpg
a3.html
bdv.html
byte.html
coc.html
dat.html
earn.html
flk-start.html
flk.html
inf.html
main-lum.txt
main-nobundles.html
main-yandex.txt
main.html
mgru.html
op-friendly.html
op.html
psdk.html
sx.html
wait.html
wps-ru.html
wps.html
preloader.html
translations.json
translations_old.json
mediaget.upd
Optifine-jarofthefree.jar
Optifine-remapped.jar
messages.json
content.js
launcheroptions.txt
7df72843-efaf-4d33-bf5e-a83b74e73c89.tmp
.3fbde34d85a0711210c1c756360283449c8f5fa9.parts
Unconfirmed 454476.crdownload
Qt5Gui.dll
Qt5WebEngineWidgets.dll
Qt5Widgets.dll
Qt5WinExtras.dll
avcodec-58.dll
avformat-58.dll
avutil-56.dll
libcrypto-1_1.dll
libssl-1_1.dll
libvlc.dll
simplexml.luac
anevia_streams.luac
anevia_xml.luac
appletrailers.luac
bbc_co_uk.luac
cue.luac
dailymotion.luac
jamendo.luac
koreus.luac
liveleak.luac
newgrounds.luac
rockbox_fm_presets.luac
soundcloud.luac
twitch.luac
vimeo.luac
vocaroo.luac
youtube.luac
mediaget-uninstaller.exe
mediaget.exe
msvcp140.dll
opencv_core320.dll
opencv_img_hash320.dll
opencv_imgcodecs320.dll
opencv_imgproc320.dll
opencv_videoio320.dll
sentry.dll
swscale-5.dll
manifest.json
manifest.json
manifest.json
manifest.json
Other
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
memory/3416-1553-0x000000006F260000-0x000000006F28F000-memory.dmp
memory/3416-1554-0x00000000665A0000-0x0000000066834000-memory.dmp
memory/5004-13228-0x00000000006F0000-0x0000000000AD8000-memory.dmp
memory/5004-13583-0x0000000010000000-0x0000000010051000-memory.dmp
memory/5004-13598-0x00000000006F0000-0x0000000000AD8000-memory.dmp
memory/5004-13668-0x00000000006F0000-0x0000000000AD8000-memory.dmp
memory/6112-1883-0x00000000110B0000-0x00000000110C0000-memory.dmp
memory/6112-3349-0x0000000071050000-0x0000000071071000-memory.dmp
memory/6112-1576-0x000000000CEC0000-0x000000000CED0000-memory.dmp
memory/6112-1599-0x000000000CF30000-0x000000000CF40000-memory.dmp
memory/6112-1598-0x000000000CF40000-0x000000000CF50000-memory.dmp
memory/6112-1619-0x000000000CF90000-0x000000000CFA0000-memory.dmp
memory/6112-1618-0x000000000CF60000-0x000000000CF70000-memory.dmp
memory/6112-1617-0x000000000CF70000-0x000000000CF80000-memory.dmp
memory/6112-1621-0x0000000010170000-0x0000000010180000-memory.dmp
memory/6112-1622-0x000000000FA00000-0x000000000FA10000-memory.dmp
memory/6112-1627-0x00000000101C0000-0x00000000101D0000-memory.dmp
memory/6112-1786-0x000000000FFE0000-0x000000000FFF0000-memory.dmp
memory/6112-1784-0x000000000FF80000-0x000000000FF90000-memory.dmp
memory/6112-1801-0x00000000108A0000-0x00000000108B0000-memory.dmp
memory/6112-1782-0x000000000FF60000-0x000000000FF70000-memory.dmp
memory/6112-1812-0x0000000010880000-0x0000000010890000-memory.dmp
memory/6112-1811-0x0000000010970000-0x0000000010980000-memory.dmp
memory/6112-1814-0x0000000010980000-0x0000000010990000-memory.dmp
memory/6112-1813-0x0000000010FE0000-0x0000000010FF0000-memory.dmp
memory/6112-1578-0x000000000CEE0000-0x000000000CEF0000-memory.dmp
memory/6112-1817-0x0000000011040000-0x0000000011050000-memory.dmp
memory/6112-1819-0x00000000107C0000-0x00000000107D0000-memory.dmp
memory/6112-1547-0x000000000CC00000-0x000000000CC10000-memory.dmp
memory/6112-1882-0x00000000122A0000-0x00000000122B0000-memory.dmp
memory/6112-1548-0x000000000CBF0000-0x000000000CC00000-memory.dmp
memory/6112-1880-0x00000000110A0000-0x00000000110B0000-memory.dmp
memory/6112-1884-0x0000000012530000-0x0000000012540000-memory.dmp
memory/6112-3325-0x000000006F260000-0x000000006F28F000-memory.dmp
memory/6112-3341-0x00000000711E0000-0x0000000071202000-memory.dmp
memory/6112-3352-0x0000000070B80000-0x0000000070B90000-memory.dmp
memory/6112-3351-0x0000000070FA0000-0x0000000070FB6000-memory.dmp
memory/6112-3350-0x0000000070FC0000-0x000000007104D000-memory.dmp
memory/6112-1516-0x000000000E900000-0x000000000E910000-memory.dmp
memory/6112-1577-0x000000000CEB0000-0x000000000CEC0000-memory.dmp
memory/6112-3348-0x0000000071080000-0x00000000710C9000-memory.dmp
memory/6112-3347-0x00000000710D0000-0x0000000071161000-memory.dmp
memory/6112-3345-0x0000000071170000-0x000000007117E000-memory.dmp
memory/6112-1517-0x000000000E8F0000-0x000000000E900000-memory.dmp
memory/6112-3344-0x0000000071180000-0x000000007118E000-memory.dmp
memory/6112-3343-0x0000000071190000-0x00000000711A6000-memory.dmp
memory/6112-1512-0x0000000004690000-0x00000000046A0000-memory.dmp
memory/6112-3342-0x00000000711B0000-0x00000000711DA000-memory.dmp
memory/6112-3335-0x0000000071440000-0x00000000716B8000-memory.dmp
memory/6112-3340-0x0000000071210000-0x0000000071224000-memory.dmp
memory/6112-1513-0x00000000042C0000-0x00000000042D0000-memory.dmp
memory/6112-1095-0x000000006F260000-0x000000006F28F000-memory.dmp
memory/6112-3326-0x00000000665A0000-0x0000000066834000-memory.dmp
memory/6112-3327-0x0000000072B40000-0x0000000072B4F000-memory.dmp
memory/6112-3328-0x0000000071C50000-0x0000000071C67000-memory.dmp
memory/6112-3329-0x0000000071C30000-0x0000000071C4D000-memory.dmp
memory/6112-3339-0x0000000071730000-0x000000007175C000-memory.dmp
memory/6112-3338-0x0000000071230000-0x000000007126D000-memory.dmp
memory/6112-3337-0x0000000071270000-0x000000007134F000-memory.dmp
memory/6112-3336-0x0000000071350000-0x0000000071435000-memory.dmp
memory/6112-1514-0x00000000046B0000-0x00000000046C0000-memory.dmp
memory/6112-3331-0x0000000071860000-0x0000000071BF2000-memory.dmp
memory/6112-3334-0x0000000071760000-0x0000000071811000-memory.dmp
memory/6112-1515-0x00000000046A0000-0x00000000046B0000-memory.dmp
memory/6112-3333-0x0000000071820000-0x000000007182E000-memory.dmp
memory/6112-3332-0x0000000071830000-0x0000000071842000-memory.dmp
memory/6112-1096-0x00000000665A0000-0x0000000066834000-memory.dmp
memory/6112-3330-0x0000000071C00000-0x0000000071C27000-memory.dmp
memory/6436-20128-0x000000001C990000-0x000000001C9DC000-memory.dmp
memory/6436-20127-0x00000000014D0000-0x00000000014D8000-memory.dmp
memory/6436-20126-0x000000001C730000-0x000000001C7CC000-memory.dmp
memory/6436-20125-0x000000001C180000-0x000000001C64E000-memory.dmp
memory/6436-20124-0x000000001BC00000-0x000000001BCA6000-memory.dmp