Event JSON
{
"id": "fa0295521864be1f3cbac8b3ca8f1f99e8f6176172ac81431e4990ceb7e7f8d4",
"pubkey": "e4d7604c8e1f57a847800792fd314500bb4416170ca1b83c4c89992f2206d496",
"created_at": 1774446738,
"kind": 1,
"tags": [
[
"imeta",
"url https://m.aqr.af/system/media_attachments/files/116/290/090/694/169/312/original/75562ab31fb524d9.png",
"m image/png"
],
[
"imeta",
"url https://m.aqr.af/system/media_attachments/files/116/290/069/507/997/783/original/60c2645093a115b0.png",
"m image/png"
],
[
"imeta",
"url https://m.aqr.af/system/media_attachments/files/116/290/112/831/963/095/original/ab113dd237a35e74.png",
"m image/png"
],
[
"proxy",
"https://m.aqr.af/@Aqraf/116290141462424343",
"web"
],
[
"proxy",
"https://m.aqr.af/users/Aqraf/statuses/116290141462424343",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://m.aqr.af/users/Aqraf/statuses/116290141462424343",
"pink.momostr"
],
[
"-"
]
],
"content": "メモリを 2.4GB ほど確保し、CPU を常に2割ほど喰っている謎の cmd.exe プロセス、タスクマネージャや Process Explorer を立ち上げると CPU を喰ってることをさとられないように動作が止まり、じゃあ procexp64.exe を procmon64.exe などにリネームして立ち上げると動作し続けるヤツが居るんだけど、たぶんマイニング的なことをやってるマルウェアなんだよな\n\n知らないところと通信してるし……\nWindows Defender はだんまりだし気味が悪すぎる\nファイアウォールで通信を遮断すると動作が止まるので、常になんかやりとりしてたっぽい\nhttps://m.aqr.af/system/media_attachments/files/116/290/069/507/997/783/original/60c2645093a115b0.png\nhttps://m.aqr.af/system/media_attachments/files/116/290/090/694/169/312/original/75562ab31fb524d9.png\nhttps://m.aqr.af/system/media_attachments/files/116/290/112/831/963/095/original/ab113dd237a35e74.png\n",
"sig": "2c7e4eaf13377fdde142b87f41c41cd6597616dcf2387adb0d114bc20887e761b3d270894d90ea32f1b645dc263da860bb82b02c04e066048ab855194c0ace07"
}
