Analysis

  • max time kernel
    110s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2023 17:18

General

  • Target

    https://telegra.ph/Adobe-Photoshop-2023-01-24-4

Malware Config

Extracted

Path

C:\Program Files\7-Zip\History.txt

Ransom Note
HISTORY of the 7-Zip -------------------- 22.01 2022-07-15 ------------------------- - UDF support was improved to UDF version 2.60. - HFS and APFS support was improved. 22.00 2022-06-15 ------------------------- - 7-Zip now can extract APFS (Apple File System) images that can be used in DMG files. - 7-Zip now can create TAR archives in POSIX (pax) tar format with the switches -ttar -mm=pax or -ttar -mm=posix - 7-Zip now can store additional file timestamps with high precision (1 ns in Linux) in tar/pax archives with the following switches: -ttar -mm=pax -mtp=3 -mtc -mta - New switches for Linux version for TAR archives: -snoi : store owner/group ids in archive or set owner/group ids from archive to extracted files. -snon : store owner/group names in archive - New -snz switch to propagate Zone.Identifier stream to extracted files (Windows). - New option "Propagate Zone.Id stream" in Tools/Options/7-Zip menu. - New "Options" window in "Add to archive" allows to select what metadata must be included to archive. Also it allows to select new option "Do not change source files last access time". - Some bugs were fixed. 21.07 2021-12-26 ------------------------- - 7-Zip now can extract VHDX disk images (Microsoft Hyper-V Virtual Hard Disk v2 format). - New switches: -spm and -im!{file_path} to exclude directories from processing for specified paths that don't contain path separator character at the end of path. - In the "Add to Archive" window, now it is allowed to use -m prefix for "Parameters" field as in command line: -mparam. - The sorting order of files in archives was slightly changed to be more consistent for cases where the name of some directory is the same as the prefix part of the name of another directory or file. - TAR archives created by 7-Zip now are more consistent with archives created by GNU TAR program. 21.06 2021-11-24 ------------------------- - The window "Add to Archive" now allows to set a limit on memory usage (RAM) that will be used for compressing. - New switch -mmemuse={N}g / -mmemuse=p{N} to set a limit on memory usage (RAM) for compressing and decompressing. - Bug in versions 21.00-21.05 was fixed: 7-Zip didn't set attributes of directories during archive extracting. - Some bugs were fixed. 21.04 beta 2021-11-02 ------------------------- - 7-Zip now reduces the number of working CPU threads for compression, if RAM size is not enough for compression with big LZMA2 dictionary. - 7-Zip now can create and check "file.sha256" text files that contain the list of file names and SHA-256 checksums in format compatible with sha256sum program. 7-Zip can work with such checksum files as with archives, but these files don't contain real file data. The context menu commands to create and test "sha256" files: 7-Zip / CRC SHA / SHA-256 -> file.sha256 7-Zip / CRC SHA / Test Archive : Checksum The commands for command line version: 7z a -thash file.sha256 *.txt 7z t -thash file.sha256 7z t -thash -shd. file.sha256 New -shd{dir_path} switch to set the directory that is used to check files referenced by "file.sha256" file for "Test" operation. If -shd{dir_path} is not specified, 7-Zip uses the directory where "file.sha256" is stored. - New -xtd switch to exclude directory metadata records from processing. 21.03 beta 2021-07-20 ------------------------- - The maximum dictionary size for LZMA/LZMA2 compressing was increased to 4 GB (3840 MiB). - Minor speed optimizations in LZMA/LZMA2 compressing. 21.02 alpha 2021-05-06 ------------------------- - 7-Zip now writes additional field for filename in UTF-8 encoding to zip archives. It allows to extract correct file name from zip archives on different systems. - The command line version of 7-Zip for macOS was released. - The speed for LZMA and LZMA2 decompression in arm64 versions for macOS and Linux was increased by 20%-60%. - Some changes and improvements in ZIP, TAR and NSIS code. 21.01 alpha 2021-03-09 ------------------------- - The command line version of 7-Zip for Linux was released. - The improvements for speed of ARM64 version using hardware CPU instructions for AES, CRC-32, SHA-1 and SHA-256. - The bug in versions 18.02 - 21.00 was fixed: 7-Zip could not correctly extract some ZIP archives created with xz compression method. - Some bugs were fixed. 21.00 alpha 2021-01-19 ------------------------- - Some internal changes in code. - Some bugs were fixed. - New localizations: Tajik, Uzbek (Cyrillic) 20.02 alpha 2020-08-08 ------------------------- - The default number of LZMA2 chunks per solid block in 7z archive was increased to 64. It allows to increase the compression speed for big 7z archives, if there is a big number of CPU cores and threads. - The speed of PPMd compressing/decompressing was increased for 7z/ZIP/RAR archives. - The new -ssp switch. If the switch -ssp is specified, 7-Zip doesn't allow the system to modify "Last Access Time" property of source files for archiving and hashing operations. - Some bugs were fixed. - New localization: Swahili. 20.00 alpha 2020-02-06 ------------------------- - 7-Zip now supports new optional match finders for LZMA/LZMA2 compression: bt5 and hc5, that can work faster than bt4 and hc4 match finders for the data with big redundancy. - The compression ratio was improved for Fast and Fastest compression levels with the following default settings: - Fastest level (-mx1) : hc5 match finder with 256 KB dictionary. - Fast level (-mx3) : hc5 match finder with 4 MB dictionary. - Minor speed optimizations in multithreaded LZMA/LZMA2 compression for Normal/Maximum/Ultra compression levels. - bzip2 decoding code was updated to support bzip2 archives, created by lbzip2 program. - Some bugs were fixed. - New localization: Turkmen. 19.02 alpha 2019-09-05 ------------------------- - 7-Zip now can unpack files encoded with Base64 encoding (b64 filename extension). - 7-Zip now can use new x86/x64 hardware instructions for SHA-1 and SHA-256, supported by AMD Ryzen and latest Intel CPUs: Ice Lake and Goldmont. It increases - the speed of SHA-1/SHA-256 hash value calculation, - the speed of encryption/decryption in zip AES, - the speed of key derivation for encryption/decryption in 7z/zip/rar archives. - The speed of zip AES encryption and 7z/zip/rar AES decryption was increased with the following improvements: - 7-Zip now can use new x86/x64 VAES (AVX Vector AES) instructions, supported by Intel Ice Lake CPU. - The existing code of x86/x64 AES-NI was improved also. - There is 2% speed optimization in 7-Zip benchmark's decompression. - Some bugs were fixed. 19.00 2019-02-21 ------------------------- - Encryption strength for 7z archives was increased: the size of random initialization vector was increased from 64-bit to 128-bit, and the pseudo-random number generator was improved. - Some bugs were fixed. 18.06 2018-12-30 ------------------------- - The speed for LZMA/LZMA2 compressing was increased by 3-10%, and there are minor changes in compression ratio. - Some bugs were fixed. - The bug in 7-Zip 18.02-18.05 was fixed: there was memory leak in xz decoder. - 7-Zip 18.02-18.05 used only one CPU thread for bz2 archive creation. 18.05 2018-04-30 ------------------------- - The speed for LZMA/LZMA2 compressing was increased by 8% for fastest/fast compression levels and by 3% for normal/maximum compression levels. - 7-Zip now shows Properties (Info) window and CRC/SHA results window as "list view" window instead of "message box" window. - Some improvements in zip, hfs and dmg code. - Previous versions of 7-Zip could work incorrectly in "Large memory pages" mode in Windows 10 because of some BUG with "Large Pages" in Windows 10. Now 7-Zip doesn't use "Large Pages" on Windows 10 up to revision 1709 (16299). - The vulnerability in RAR unpacking code was fixed (CVE-2018-10115). - Some bugs were fixed. 18.03 beta 2018-03-04 ------------------------- - The speed for single-thread LZMA/LZMA2 decoding was increased by 30% in x64 version and by 3% in x86 version. - 7-Zip now can use multi-threading for 7z/LZMA2 decoding, if there are multiple independent data chunks in LZMA2 stream. - 7-Zip now can use multi-threading for xz decoding, if there are multiple blocks in xz stream. - New localization: Kabyle. - Some bugs were fixed. 18.01 2018-01-28 ------------------------- - 7-Zip now can unpack DMG archives that use LZFSE compression method. - 7-Zip now doesn't allow update operation for archives that have read-only attribute. - The BUG was fixed: extracting from tar with -si switch didn't set timestamps for directories. - Some bugs were fixed. 18.00 beta 2018-01-10 ------------------------- - 7-Zip now can unpack OBJ/COFF files. - new -sse switch to stop archive creating, if 7-Zip can't open some input file. - Some bugs were fixed. 17.01 beta 2017-08-28 ------------------------- - Minor speed optimization for LZMA2 (xz and 7z) multi-threading compression. 7-Zip now uses additional memory buffers for multi-block LZMA2 compression. CPU utilization was slightly improved. - 7-zip now creates multi-block xz archives by default. Block size can be specified with -ms[Size]{m|g} switch. - xz decoder now can unpack random block from multi-block xz archives. 7-Zip File Manager now can open nested multi-block xz archives (for example, image.iso.xz) without full unpacking of xz archive. - 7-Zip now can create zip archives from stdin to stdout. - 7-Zip command line: @listfile now doesn't work after -- switch. Use -i@listfile before -- switch instead. - The BUGs were fixed: 7-Zip could add unrequired alternate file streams to WIM archives, for commands that contain filename wildcards and -sns switch. 7-Zip 17.00 beta crashed for commands that write anti-item to 7z archive. 7-Zip 17.00 beta ignored "Use large memory pages" option. 17.00 beta 2017-04-29 ------------------------- - ZIP unpacking code was improved. - 7-Zip now reserves file space before writing to file (for extraction from archive). It can reduce file fragmentation. - Some bugs were fixed. 7-Zip could crash in some cases. - Internal changes in code. 16.04 2016-10-04 ------------------------- - The bug was fixed: 7-Zip 16.03 exe installer under Vista didn't create links in Start / Programs menu. - Some bugs were fixed in RAR code. 16.03 2016-09-28 ------------------------- - Installer and SFX modules now use some protection against DLL preloading attack. - Some bugs were fixed in 7z, NSIS, SquashFS, RAR5 and another code. 16.02 2016-05-21 ------------------------- - 7-Zip now can extract multivolume ZIP archives (z01, z02, ... , zip). - Some bugs were fixed. 15.14 2015-12-31 ------------------------- - 7-Zip File Manager: - The code for "Open file from archive" operation was improved. - The code for "Tools/Options" window was improved. - The BUG was fixed: there was incorrect mouse cursor capture for drag-and-drop operations from open archive to Explorer window. - Some bugs were fixed. - New localization: Yoruba. 15.12 2015-11-19 ------------------------- - The release version. 15.11 beta 2015-11-14 ------------------------- - Some bugs were fixed. 15.10 beta 2015-11-01 ------------------------- - The BUG in 9.21 - 15.09 was fixed: 7-Zip could ignore some parameters, specified for archive creation operation for gzip and bzip2 formats in "Add to Archive" window and in command line version (-m switch). - Some bugs were fixed. 15.09 beta 2015-10-16 ------------------------- - 7-Zip now can extract ext2 and multivolume VMDK images. - Some bugs were fixed. 15.08 beta 2015-10-01 ------------------------- - 7-Zip now can extract ext3 and ext4 (Linux file system) images. - Some bugs were fixed. 15.07 beta 2015-09-17 ------------------------- - 7-Zip now can extract GPT images and single file QCOW2, VMDK, VDI images. - 7-Zip now can extract solid WIM archives with LZMS compression. - Some bugs were fixed. 15.06 beta 2015-08-09 ------------------------- - 7-Zip now can extract RAR5 archives. - 7-Zip now doesn't sort files by type while adding to solid 7z archive. - new -mqs switch to sort files by type while adding to solid 7z archive. - The BUG in 7-Zip File Manager was fixed: The "Move" operation to open 7z archive didn't delete empty files. - The BUG in 15.05 was fixed: console version added some text to the end of stdout stream, is -so switch was used. - The BUG in 9.30 - 15.05 was fixed: 7-Zip could not open multivolume sfx RAR archive. - Some bugs were fixed. 15.05 beta 2015-06-14 ------------------------- - 7-Zip now uses new installer. - 7-Zip now can create 7z, xz and zip archives with 1536 MB dictionary for LZMA/LZMA2. - 7-Zip File Manager now can operate with alternate file streams at NTFS volumes via "File / Alternate Streams" menu command. - 7-Zip now can extract .zipx (WinZip) archives that use xz compression. - new optional "section size" parameter for BCJ2 filter for compression ratio improving. Example: -mf=BCJ2:d9M, if largest executable section in files is smaller than 9 MB. - Speed optimizations for BCJ2 filter and SHA-1 and SHA-256 calculation. - Console version now uses stderr stream for error messages. - Console version now shows names of processed files only in progress line by default. - new -bb[0-3] switch to set output log level. -bb1 shows names of processed files in log. - new -bs[o|e|p][0|1|2] switch to set stream for output messages; o: output, e: error, p: progress line; 0: disable, 1: stdout, 2: stderr. - new -bt switch to show execution time statistics. - new -myx[0-9] switch to set level of file analysis. - new -mmtf- switch to set single thread mode for filters. - The BUG was fixed: 7-Zip didn't restore NTFS permissions for folders during extracting from WIM archives. - The BUG was fixed: The command line version: if the command "rn" (Rename) was called with more than one pair of paths, 7-Zip used only first rename pair. - The BUG was fixed: 7-Zip crashed for ZIP/LZMA/AES/AES-NI. - The BUG in 15.01-15.02 was fixed: 7-Zip created incorrect ZIP archives, if ZipCrypto encryption was used. 7-Zip 9.20 can extract such incorrect ZIP archives. - Some bugs were fixed. 9.38 beta 2015-01-03 ------------------------- - Some bugs were fixed. 9.36 beta 2014-12-26 ------------------------- - The BUG in command line version was fixed: 7-Zip created temporary archive in current folder during update archive operation, if -w{Path} switch was not specified. The fixed 7-Zip creates temporary archive in folder that contains updated archive. - The BUG in 9.33-9.35 was fixed: 7-Zip silently ignored file reading errors during 7z or gz archive creation, and the created archive contained only part of file that was read before error. The fixed 7-Zip stops archive creation and it reports about error. - Some bugs were fixed. 9.35 beta 2014-12-07 ------------------------- - The BUG was fixed: 7-Zip crashed during ZIP archive creation, if the number of CPU threads was more than 64. - The BUG in 9.31-9.34 was fixed: 7-Zip could not correctly extract ISO archives that are larger than 4 GiB. - The BUG in 9.33-9.34 was fixed: The option "Compress shared files" and -ssw switch didn't work. - The BUG in 9.26-9.34 was fixed: 7-Zip File Manager could crash for some archives open in "Flat View" mode. - Some bugs were fixed. 9.34 alpha 2014-06-22 ------------------------- - The BUG in 9.33 was fixed: Command line version of 7-Zip could work incorrectly, if there is relative path in exclude filename optiton (-x) an

Extracted

Family

vidar

Version

2.2

Botnet

754

C2

https://t.me/litlebey

https://steamcommunity.com/profiles/76561199472399815

Attributes
  • profile_id

    754

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 7 IoCs
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 33 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://telegra.ph/Adobe-Photoshop-2023-01-24-4
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4920
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ff94a624f50,0x7ff94a624f60,0x7ff94a624f70
      2⤵
        PID:4964
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1648 /prefetch:2
        2⤵
          PID:3700
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2032 /prefetch:8
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2092
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2304 /prefetch:8
          2⤵
            PID:4796
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
            2⤵
              PID:4680
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:1
              2⤵
                PID:4208
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4604 /prefetch:8
                2⤵
                  PID:3960
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
                  2⤵
                    PID:4944
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
                    2⤵
                      PID:2036
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4384 /prefetch:8
                      2⤵
                        PID:4608
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4328 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4316
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
                        2⤵
                          PID:3020
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6080 /prefetch:8
                          2⤵
                            PID:4100
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
                            2⤵
                              PID:4428
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2352
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4552
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4588 /prefetch:8
                              2⤵
                                PID:1884
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6420 /prefetch:8
                                2⤵
                                  PID:2028
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6436 /prefetch:8
                                  2⤵
                                    PID:1856
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
                                    2⤵
                                      PID:2736
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
                                      2⤵
                                        PID:5020
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
                                        2⤵
                                          PID:1476
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7228 /prefetch:1
                                          2⤵
                                            PID:4976
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7240 /prefetch:1
                                            2⤵
                                              PID:2400
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7348 /prefetch:1
                                              2⤵
                                                PID:3436
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
                                                2⤵
                                                  PID:4760
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:1
                                                  2⤵
                                                    PID:1264
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
                                                    2⤵
                                                      PID:4004
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7868 /prefetch:8
                                                      2⤵
                                                        PID:2780
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7968 /prefetch:8
                                                        2⤵
                                                          PID:4892
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8076 /prefetch:8
                                                          2⤵
                                                            PID:5132
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8036 /prefetch:1
                                                            2⤵
                                                              PID:5208
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8400 /prefetch:1
                                                              2⤵
                                                                PID:5292
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9032 /prefetch:1
                                                                2⤵
                                                                  PID:5344
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9200 /prefetch:1
                                                                  2⤵
                                                                    PID:5396
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7772 /prefetch:8
                                                                    2⤵
                                                                      PID:5596
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6576 /prefetch:8
                                                                      2⤵
                                                                        PID:5588
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8420 /prefetch:8
                                                                        2⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:5808
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4800 /prefetch:8
                                                                        2⤵
                                                                          PID:5876
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6504 /prefetch:8
                                                                          2⤵
                                                                            PID:5868
                                                                          • C:\Users\Admin\Downloads\7z2201-x64.exe
                                                                            "C:\Users\Admin\Downloads\7z2201-x64.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Registers COM server for autorun
                                                                            • Drops file in Program Files directory
                                                                            • Modifies registry class
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:5928
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
                                                                            2⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:5508
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
                                                                            2⤵
                                                                              PID:3088
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
                                                                              2⤵
                                                                                PID:2560
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
                                                                                2⤵
                                                                                  PID:4120
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7496 /prefetch:1
                                                                                  2⤵
                                                                                    PID:5248
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
                                                                                    2⤵
                                                                                      PID:5616
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=812 /prefetch:8
                                                                                      2⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:5388
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1568 /prefetch:8
                                                                                      2⤵
                                                                                        PID:3768
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8132 /prefetch:8
                                                                                        2⤵
                                                                                          PID:1960
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
                                                                                          2⤵
                                                                                            PID:1992
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:1
                                                                                            2⤵
                                                                                              PID:2864
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
                                                                                              2⤵
                                                                                                PID:1068
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:5876
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8136 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:5916
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1580 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:6004
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:2044
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9228 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:5016
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7760 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:6136
                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:3748
                                                                                                          • C:\Windows\system32\OpenWith.exe
                                                                                                            C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                            1⤵
                                                                                                            • Modifies registry class
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:4120
                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 444 -p 4860 -ip 4860
                                                                                                            1⤵
                                                                                                              PID:5744
                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                              C:\Windows\system32\WerFault.exe -u -p 4860 -s 776
                                                                                                              1⤵
                                                                                                              • Program crash
                                                                                                              PID:5764
                                                                                                            • C:\Windows\System32\rundll32.exe
                                                                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                              1⤵
                                                                                                                PID:3636
                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                1⤵
                                                                                                                • Modifies registry class
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:3776
                                                                                                              • C:\Program Files\7-Zip\7zFM.exe
                                                                                                                "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Adobe Photoshop 2023.rar"
                                                                                                                1⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Loads dropped DLL
                                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                PID:5568
                                                                                                              • C:\Users\Admin\Desktop\AppSetup.exe
                                                                                                                "C:\Users\Admin\Desktop\AppSetup.exe"
                                                                                                                1⤵
                                                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                • Executes dropped EXE
                                                                                                                • Checks BIOS information in registry
                                                                                                                • Checks whether UAC is enabled
                                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                PID:5600
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                                                                                                  2⤵
                                                                                                                  • Loads dropped DLL
                                                                                                                  • Checks processor information in registry
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:5220
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" & exit
                                                                                                                    3⤵
                                                                                                                      PID:5352
                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                        timeout /t 6
                                                                                                                        4⤵
                                                                                                                        • Delays execution with timeout.exe
                                                                                                                        PID:1812

                                                                                                                Network

                                                                                                                MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                Persistence

                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                1
                                                                                                                T1060

                                                                                                                Bootkit

                                                                                                                1
                                                                                                                T1067

                                                                                                                Defense Evasion

                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                1
                                                                                                                T1497

                                                                                                                Credential Access

                                                                                                                Credentials in Files

                                                                                                                2
                                                                                                                T1081

                                                                                                                Discovery

                                                                                                                Query Registry

                                                                                                                5
                                                                                                                T1012

                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                1
                                                                                                                T1497

                                                                                                                System Information Discovery

                                                                                                                5
                                                                                                                T1082

                                                                                                                Collection

                                                                                                                Data from Local System

                                                                                                                2
                                                                                                                T1005

                                                                                                                Replay Monitor

                                                                                                                Loading Replay Monitor...

                                                                                                                Downloads

                                                                                                                • C:\Program Files\7-Zip\7-zip.dll
                                                                                                                  Filesize

                                                                                                                  92KB

                                                                                                                  MD5

                                                                                                                  c3af132ea025d289ab4841fc00bb74af

                                                                                                                  SHA1

                                                                                                                  0a9973d5234cc55b8b97bbb82c722b910c71cbaf

                                                                                                                  SHA256

                                                                                                                  56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

                                                                                                                  SHA512

                                                                                                                  707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

                                                                                                                • C:\Program Files\7-Zip\7-zip.dll
                                                                                                                  Filesize

                                                                                                                  92KB

                                                                                                                  MD5

                                                                                                                  c3af132ea025d289ab4841fc00bb74af

                                                                                                                  SHA1

                                                                                                                  0a9973d5234cc55b8b97bbb82c722b910c71cbaf

                                                                                                                  SHA256

                                                                                                                  56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

                                                                                                                  SHA512

                                                                                                                  707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

                                                                                                                • C:\Program Files\7-Zip\7-zip.dll
                                                                                                                  Filesize

                                                                                                                  92KB

                                                                                                                  MD5

                                                                                                                  c3af132ea025d289ab4841fc00bb74af

                                                                                                                  SHA1

                                                                                                                  0a9973d5234cc55b8b97bbb82c722b910c71cbaf

                                                                                                                  SHA256

                                                                                                                  56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

                                                                                                                  SHA512

                                                                                                                  707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

                                                                                                                • C:\Program Files\7-Zip\7-zip.dll
                                                                                                                  Filesize

                                                                                                                  92KB

                                                                                                                  MD5

                                                                                                                  c3af132ea025d289ab4841fc00bb74af

                                                                                                                  SHA1

                                                                                                                  0a9973d5234cc55b8b97bbb82c722b910c71cbaf

                                                                                                                  SHA256

                                                                                                                  56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

                                                                                                                  SHA512

                                                                                                                  707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

                                                                                                                • C:\Program Files\7-Zip\7z.dll
                                                                                                                  Filesize

                                                                                                                  1.7MB

                                                                                                                  MD5

                                                                                                                  bbf51226a8670475f283a2d57460d46c

                                                                                                                  SHA1

                                                                                                                  6388883ced0ce14ede20c7798338673ff8d6204a

                                                                                                                  SHA256

                                                                                                                  73578f14d50f747efa82527a503f1ad542f9db170e2901eddb54d6bce93fc00e

                                                                                                                  SHA512

                                                                                                                  f68eb9c4ba0d923082107cff2f0e7f78e80be243b9d92cfab7298f59461fcca2c5c944d4577f161f11a2011c0958a3c32896eba4f0e89cd9f8aed97ab5bc74f9

                                                                                                                • C:\Program Files\7-Zip\7z.dll
                                                                                                                  Filesize

                                                                                                                  1.7MB

                                                                                                                  MD5

                                                                                                                  bbf51226a8670475f283a2d57460d46c

                                                                                                                  SHA1

                                                                                                                  6388883ced0ce14ede20c7798338673ff8d6204a

                                                                                                                  SHA256

                                                                                                                  73578f14d50f747efa82527a503f1ad542f9db170e2901eddb54d6bce93fc00e

                                                                                                                  SHA512

                                                                                                                  f68eb9c4ba0d923082107cff2f0e7f78e80be243b9d92cfab7298f59461fcca2c5c944d4577f161f11a2011c0958a3c32896eba4f0e89cd9f8aed97ab5bc74f9

                                                                                                                • C:\Program Files\7-Zip\7zFM.exe
                                                                                                                  Filesize

                                                                                                                  935KB

                                                                                                                  MD5

                                                                                                                  d36deceeb4c9645aab2ded86608d090b

                                                                                                                  SHA1

                                                                                                                  912f4658c4b046fbadd084912f9126cb1ae3737b

                                                                                                                  SHA256

                                                                                                                  018d74ff917692124dee0a8a7e6302aecd219d79b049ad95f2f4eedea41b4a45

                                                                                                                  SHA512

                                                                                                                  9752a9e57dd2e6cd454ba6c2d041d884369734c2b62c53d3ec4854731c398cd6e25ac75f7a55cda9d4b4c2efb074cb2e6efcbf3080cd8cc7d9bc8c9a25f62ff2

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
                                                                                                                  MD5

                                                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                                                  SHA1

                                                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                  SHA256

                                                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                  SHA512

                                                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                • C:\Users\Admin\Downloads\7z2201-x64.exe
                                                                                                                  Filesize

                                                                                                                  1.5MB

                                                                                                                  MD5

                                                                                                                  a6a0f7c173094f8dafef996157751ecf

                                                                                                                  SHA1

                                                                                                                  c0dcae7c4c80be25661d22400466b4ea074fc580

                                                                                                                  SHA256

                                                                                                                  b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

                                                                                                                  SHA512

                                                                                                                  965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

                                                                                                                • C:\Users\Admin\Downloads\7z2201-x64.exe
                                                                                                                  Filesize

                                                                                                                  1.5MB

                                                                                                                  MD5

                                                                                                                  a6a0f7c173094f8dafef996157751ecf

                                                                                                                  SHA1

                                                                                                                  c0dcae7c4c80be25661d22400466b4ea074fc580

                                                                                                                  SHA256

                                                                                                                  b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

                                                                                                                  SHA512

                                                                                                                  965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

                                                                                                                • C:\Users\Admin\Downloads\Adobe Photoshop 2023.rar
                                                                                                                  Filesize

                                                                                                                  5.6MB

                                                                                                                  MD5

                                                                                                                  469cef40c7b0d33b58350f8f85f4f9c1

                                                                                                                  SHA1

                                                                                                                  77965fe37e14e6a1512f90be9f4ae405c47ce117

                                                                                                                  SHA256

                                                                                                                  d19349d59803f106225124147a68b85f4a7557e01741f2295d37b6b42bfaba3b

                                                                                                                  SHA512

                                                                                                                  f2384c1e76147462f51d7008f725772ff92777b1afed5cb50ee159de99b4b8978ef042513d02f3ddf27915ae39d342a792043b4b76182cabf8bb5bb298180300

                                                                                                                • \??\pipe\crashpad_4920_VXMHNRYTOCLUMQNC
                                                                                                                  MD5

                                                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                                                  SHA1

                                                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                  SHA256

                                                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                  SHA512

                                                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                • memory/1812-181-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5220-155-0x0000000000400000-0x000000000046A000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  424KB

                                                                                                                • memory/5220-178-0x0000000000400000-0x000000000046A000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  424KB

                                                                                                                • memory/5220-180-0x0000000000400000-0x000000000046A000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  424KB

                                                                                                                • memory/5220-159-0x0000000060900000-0x0000000060992000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  584KB

                                                                                                                • memory/5220-151-0x0000000000400000-0x000000000046A000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  424KB

                                                                                                                • memory/5220-152-0x000000000042D1BC-mapping.dmp
                                                                                                                • memory/5220-153-0x0000000000400000-0x000000000046A000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  424KB

                                                                                                                • memory/5220-154-0x0000000000400000-0x000000000046A000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  424KB

                                                                                                                • memory/5352-179-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5600-145-0x0000000000390000-0x0000000001302000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  15.4MB

                                                                                                                • memory/5600-156-0x0000000000390000-0x0000000001302000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  15.4MB

                                                                                                                • memory/5600-157-0x00007FF967790000-0x00007FF967985000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  2.0MB

                                                                                                                • memory/5600-158-0x00007FF944080000-0x00007FF944B41000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  10.8MB

                                                                                                                • memory/5600-150-0x00007FF944080000-0x00007FF944B41000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  10.8MB

                                                                                                                • memory/5600-146-0x00007FF967790000-0x00007FF967985000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  2.0MB

                                                                                                                • memory/5600-149-0x0000000000390000-0x0000000001302000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  15.4MB

                                                                                                                • memory/5928-133-0x0000000000000000-mapping.dmp