amadey | 4472ae43b8f3acc33dc1c804fa59e4255192efb57199c1ece226c5a9f5493769

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe

Downloads MZ/PE file

.NET Reactor proctector 4 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral3/memory/5608-936-0x0000000002610000-0x0000000002674000-memory.dmp	net_reactor
behavioral3/memory/5208-954-0x0000000000420000-0x0000000000D34000-memory.dmp	net_reactor
behavioral3/memory/5608-950-0x0000000004A50000-0x0000000004AB4000-memory.dmp	net_reactor
behavioral3/files/0x000a0000000232e6-2024.dat	net_reactor

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	setup.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2580	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 27 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral3/memory/2944-0-0x00007FF6C6C00000-0x00007FF6C75F1000-memory.dmp	themida
behavioral3/memory/2944-1-0x00007FF6C6C00000-0x00007FF6C75F1000-memory.dmp	themida
behavioral3/memory/2944-10-0x00007FF6C6C00000-0x00007FF6C75F1000-memory.dmp	themida
behavioral3/memory/2944-12-0x00007FF6C6C00000-0x00007FF6C75F1000-memory.dmp	themida
behavioral3/memory/2944-13-0x00007FF6C6C00000-0x00007FF6C75F1000-memory.dmp	themida
behavioral3/memory/2944-14-0x00007FF6C6C00000-0x00007FF6C75F1000-memory.dmp	themida
behavioral3/memory/2944-15-0x00007FF6C6C00000-0x00007FF6C75F1000-memory.dmp	themida
behavioral3/memory/2944-16-0x00007FF6C6C00000-0x00007FF6C75F1000-memory.dmp	themida
behavioral3/memory/2944-17-0x00007FF6C6C00000-0x00007FF6C75F1000-memory.dmp	themida
behavioral3/memory/2944-18-0x00007FF6C6C00000-0x00007FF6C75F1000-memory.dmp	themida
behavioral3/memory/2944-19-0x00007FF6C6C00000-0x00007FF6C75F1000-memory.dmp	themida
behavioral3/memory/2944-61-0x00007FF6C6C00000-0x00007FF6C75F1000-memory.dmp	themida
behavioral3/memory/2944-171-0x00007FF6C6C00000-0x00007FF6C75F1000-memory.dmp	themida
behavioral3/files/0x0006000000023241-380.dat	themida
behavioral3/files/0x0006000000023242-373.dat	themida
behavioral3/files/0x0006000000023249-268.dat	themida
behavioral3/files/0x0006000000023241-815.dat	themida
behavioral3/files/0x0006000000023241-783.dat	themida
behavioral3/files/0x0006000000023242-914.dat	themida
behavioral3/files/0x0006000000023249-913.dat	themida
behavioral3/files/0x0006000000023249-912.dat	themida
behavioral3/memory/5220-943-0x00000000004E0000-0x0000000001493000-memory.dmp	themida
behavioral3/memory/4324-956-0x00000000000A0000-0x0000000000D9F000-memory.dmp	themida
behavioral3/memory/2944-973-0x00007FF6C6C00000-0x00007FF6C75F1000-memory.dmp	themida
behavioral3/memory/5208-982-0x0000000000420000-0x0000000000D34000-memory.dmp	themida
behavioral3/memory/5220-991-0x00000000004E0000-0x0000000001493000-memory.dmp	themida
behavioral3/files/0x0006000000023242-1065.dat	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 14 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
143	ipinfo.io
144	ipinfo.io
9	api.myip.com
130	api.2ip.ua
139	api.myip.com
167	api.myip.com
258	ipinfo.io
259	ipinfo.io
262	ipinfo.io
17	api.myip.com
20	ipinfo.io
169	ipinfo.io
21	ipinfo.io
128	api.2ip.ua

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral3/files/0x000c000000023340-1974.dat	autoit_exe
behavioral3/files/0x0007000000023348-2091.dat	autoit_exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2944	setup.exe

Program crash 23 IoCs

pid	pid_target	Process	procid_target
5960	5896	WerFault.exe	109
5000	2828	WerFault.exe	99
2484	1656	WerFault.exe	141
2392	228	WerFault.exe	147
5012	228	WerFault.exe	147
3996	228	WerFault.exe	147
5076	228	WerFault.exe	147
5496	228	WerFault.exe	147
5080	228	WerFault.exe	147
5672	228	WerFault.exe	147
4228	228	WerFault.exe	147
3260	228	WerFault.exe	147
5496	5484	WerFault.exe	98
5820	228	WerFault.exe	147
4836	2396	WerFault.exe
4352	228	WerFault.exe	147
3900	228	WerFault.exe	147
5304	228	WerFault.exe	147
1936	228	WerFault.exe	147
2800	228	WerFault.exe	147
3212	4324	WerFault.exe	104
1080	228	WerFault.exe	147
6132	228	WerFault.exe	147

Creates scheduled task(s) 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
5472	schtasks.exe
4320	schtasks.exe
5268	schtasks.exe
3372	schtasks.exe
1692	schtasks.exe
5404	schtasks.exe
5912	schtasks.exe
1784	schtasks.exe
4476	schtasks.exe
3940	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3800	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2944	setup.exe
2944	setup.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2944
- C:\Users\Admin\Documents\GuardFox\gcS6C1YUmi1GHPyeuHYYA9sT.exe
  "C:\Users\Admin\Documents\GuardFox\gcS6C1YUmi1GHPyeuHYYA9sT.exe"
  2⤵
  PID:1108
- - C:\Users\Admin\AppData\Local\Temp\is-7U4FG.tmp\gcS6C1YUmi1GHPyeuHYYA9sT.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-7U4FG.tmp\gcS6C1YUmi1GHPyeuHYYA9sT.tmp" /SL5="$B0160,3763271,54272,C:\Users\Admin\Documents\GuardFox\gcS6C1YUmi1GHPyeuHYYA9sT.exe"
    3⤵
    PID:5096
  - - C:\Users\Admin\AppData\Local\Web Resource Viewer\webresourceviewer.exe
      "C:\Users\Admin\AppData\Local\Web Resource Viewer\webresourceviewer.exe" -i
      4⤵
      PID:5596
  - - C:\Users\Admin\AppData\Local\Web Resource Viewer\webresourceviewer.exe
      "C:\Users\Admin\AppData\Local\Web Resource Viewer\webresourceviewer.exe" -s
      4⤵
      PID:6040
- C:\Users\Admin\Documents\GuardFox\vzE4LAcixJ2nhR22CnKfYYnF.exe
  "C:\Users\Admin\Documents\GuardFox\vzE4LAcixJ2nhR22CnKfYYnF.exe"
  2⤵
  PID:4164
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4476
- - C:\Users\Admin\AppData\Local\Temp\jobA4uNtTN4XMoaksB\ZkUEpjzU_OY3NnQNgu5D.exe
    "C:\Users\Admin\AppData\Local\Temp\jobA4uNtTN4XMoaksB\ZkUEpjzU_OY3NnQNgu5D.exe"
    3⤵
    PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      PID:2944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa4f8746f8,0x7ffa4f874708,0x7ffa4f874718
        5⤵
        
        PID:1760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,9969108966913276288,13840086140193668100,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2996 /prefetch:8
        5⤵
        
        PID:5140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9969108966913276288,13840086140193668100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
        5⤵
        
        PID:6196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9969108966913276288,13840086140193668100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
        5⤵
        
        PID:6184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,9969108966913276288,13840086140193668100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 /prefetch:3
        5⤵
        
        PID:3800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,9969108966913276288,13840086140193668100,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
        5⤵
        
        PID:5416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9969108966913276288,13840086140193668100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
        5⤵
        
        PID:4476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9969108966913276288,13840086140193668100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
        5⤵
        
        PID:4456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9969108966913276288,13840086140193668100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
        5⤵
        
        PID:7724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9969108966913276288,13840086140193668100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
        5⤵
        
        PID:7500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9969108966913276288,13840086140193668100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
        5⤵
        
        PID:7320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9969108966913276288,13840086140193668100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
        5⤵
        
        PID:7592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9969108966913276288,13840086140193668100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
        5⤵
        
        PID:8468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9969108966913276288,13840086140193668100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
        5⤵
        
        PID:6404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9969108966913276288,13840086140193668100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
        5⤵
        
        PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      PID:4856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa4f8746f8,0x7ffa4f874708,0x7ffa4f874718
        5⤵
        
        PID:1484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,13639707827365345076,16602604418031529640,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
        5⤵
        
        PID:6824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:4984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd8,0x110,0x7ffa4f8746f8,0x7ffa4f874708,0x7ffa4f874718
        5⤵
        
        PID:5844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1448,16338502397926086022,8312028227154473661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:3
        5⤵
        
        PID:6988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
      4⤵
      PID:4148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa4f8746f8,0x7ffa4f874708,0x7ffa4f874718
        5⤵
        
        PID:4084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,8276629622273914581,11034228161563388906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:3
        5⤵
        
        PID:7616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/login
      4⤵
      PID:4364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4f8746f8,0x7ffa4f874708,0x7ffa4f874718
        5⤵
        
        PID:1936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,8680983948831886211,6150093533880543231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
        5⤵
        
        PID:6960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
      4⤵
      PID:5016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa4f8746f8,0x7ffa4f874708,0x7ffa4f874718
        5⤵
        
        PID:4216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,5215836628163227047,16097009768951431144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
        5⤵
        
        PID:7324
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
      4⤵
      PID:5108
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa4f2e9758,0x7ffa4f2e9768,0x7ffa4f2e9778
        5⤵
        
        PID:4500
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1944 --field-trial-handle=1984,i,15517944134324078260,6342205190997148227,131072 /prefetch:8
        5⤵
        
        PID:8216
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/login
      4⤵
      PID:1908
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x80,0x7ffa4f2e9758,0x7ffa4f2e9768,0x7ffa4f2e9778
        5⤵
        
        PID:5004
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4300 --field-trial-handle=2140,i,1717692721375367046,10332440191045247170,131072 /prefetch:1
        5⤵
        
        PID:9440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
      4⤵
      PID:868
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4f2e9758,0x7ffa4f2e9768,0x7ffa4f2e9778
        5⤵
        
        PID:6444
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 --field-trial-handle=1996,i,10960955463845327654,16935393170811479102,131072 /prefetch:2
        5⤵
        
        PID:9640
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=1996,i,10960955463845327654,16935393170811479102,131072 /prefetch:8
        5⤵
        
        PID:9852
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
      4⤵
      PID:6940
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login
      4⤵
      PID:6952
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login
        5⤵
        
        PID:6964
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6964.0.1266229302\1283548105" -parentBuildID 20221007134813 -prefsHandle 1684 -prefMapHandle 1688 -prefsLen 17556 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {81327c04-4187-43ba-b58e-033c854edf8b} 6964 "\\.\pipe\gecko-crash-server-pipe.6964" 1788 2868f1d8658 gpu
        6⤵
        
        PID:7376
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6964.1.563201532\163556534" -parentBuildID 20221007134813 -prefsHandle 2036 -prefMapHandle 2032 -prefsLen 17556 -prefMapSize 230321 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7803640-be9e-4e27-8f47-0f76ef1ce00c} 6964 "\\.\pipe\gecko-crash-server-pipe.6964" 2052 2868f64c258 socket
        6⤵
        
        PID:6264
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
      4⤵
      PID:4644
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
        5⤵
        
        PID:7172
- - C:\Users\Admin\AppData\Local\Temp\jobA4uNtTN4XMoaksB\ZM06EX0XLzXQB6JmZB6D.exe
    "C:\Users\Admin\AppData\Local\Temp\jobA4uNtTN4XMoaksB\ZM06EX0XLzXQB6JmZB6D.exe"
    3⤵
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe
      "C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe"
      4⤵
      PID:4516
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\1000495001\SetupPowerGREPDemo.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000495001\SetupPowerGREPDemo.exe"
        5⤵
        
        PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\1000540001\rback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000540001\rback.exe"
        5⤵
        
        PID:9040
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        5⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\1000546001\rdx1122.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000546001\rdx1122.exe"
        5⤵
        
        PID:7616
- - C:\Users\Admin\AppData\Local\Temp\jobA4uNtTN4XMoaksB\IiEX9JsqAf4CvK_IIUqk.exe
    "C:\Users\Admin\AppData\Local\Temp\jobA4uNtTN4XMoaksB\IiEX9JsqAf4CvK_IIUqk.exe"
    3⤵
    PID:4228
- - C:\Users\Admin\AppData\Local\Temp\jobA4uNtTN4XMoaksB\LAgZ8YV96YKyFRxto4SW.exe
    "C:\Users\Admin\AppData\Local\Temp\jobA4uNtTN4XMoaksB\LAgZ8YV96YKyFRxto4SW.exe"
    3⤵
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\jobA4uNtTN4XMoaksB\gcJW5PknhHgzcwmVNm4C.exe
    "C:\Users\Admin\AppData\Local\Temp\jobA4uNtTN4XMoaksB\gcJW5PknhHgzcwmVNm4C.exe"
    3⤵
    PID:6016
- C:\Users\Admin\Documents\GuardFox\ez0lONedq0sNRuVm6IujFZx5.exe
  "C:\Users\Admin\Documents\GuardFox\ez0lONedq0sNRuVm6IujFZx5.exe"
  2⤵
  PID:5484
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Documents\GuardFox\ez0lONedq0sNRuVm6IujFZx5.exe" & del "C:\ProgramData\*.dll"" & exit
    3⤵
    PID:2016
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5484 -s 2428
    3⤵
    - Program crash
    PID:5496
- C:\Users\Admin\Documents\GuardFox\MZJRGpPP58O18q3oYGKpBRCP.exe
  "C:\Users\Admin\Documents\GuardFox\MZJRGpPP58O18q3oYGKpBRCP.exe"
  2⤵
  PID:2828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 512
    3⤵
    - Program crash
    PID:5000
- C:\Users\Admin\Documents\GuardFox\83Ggchc9F5VSXbaqbWrEiBb_.exe
  "C:\Users\Admin\Documents\GuardFox\83Ggchc9F5VSXbaqbWrEiBb_.exe"
  2⤵
  PID:4412
- C:\Users\Admin\Documents\GuardFox\XI6XN15m7JVoQLPuT7dmidu8.exe
  "C:\Users\Admin\Documents\GuardFox\XI6XN15m7JVoQLPuT7dmidu8.exe"
  2⤵
  PID:4324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH1\MPGPH1.exe" /tn "MPGPH1 HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH1\MPGPH1.exe" /tn "MPGPH1 LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 1388
    3⤵
    - Program crash
    PID:3212
- C:\Users\Admin\Documents\GuardFox\laqEkiUgQ7lgU1CF4SddhJTH.exe
  "C:\Users\Admin\Documents\GuardFox\laqEkiUgQ7lgU1CF4SddhJTH.exe"
  2⤵
  PID:1904
- - C:\Users\Admin\Documents\GuardFox\laqEkiUgQ7lgU1CF4SddhJTH.exe
    "C:\Users\Admin\Documents\GuardFox\laqEkiUgQ7lgU1CF4SddhJTH.exe"
    3⤵
    PID:5796
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\7b20a8d9-72b2-4dee-addd-e2e347f9c5a1" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      4⤵
      Modifies file permissions
      PID:2580
  - - C:\Users\Admin\Documents\GuardFox\laqEkiUgQ7lgU1CF4SddhJTH.exe
      "C:\Users\Admin\Documents\GuardFox\laqEkiUgQ7lgU1CF4SddhJTH.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:1704
- C:\Users\Admin\Documents\GuardFox\0tFBWi1QbQ9aPQO60UuIjAd3.exe
  "C:\Users\Admin\Documents\GuardFox\0tFBWi1QbQ9aPQO60UuIjAd3.exe"
  2⤵
  PID:3620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5472
- C:\Users\Admin\Documents\GuardFox\jIp4Xi31R5Gu0Pv21yInP_bs.exe
  "C:\Users\Admin\Documents\GuardFox\jIp4Xi31R5Gu0Pv21yInP_bs.exe"
  2⤵
  PID:3796
- C:\Users\Admin\Documents\GuardFox\vINdr611kfZxvlMUW1a4TJjp.exe
  "C:\Users\Admin\Documents\GuardFox\vINdr611kfZxvlMUW1a4TJjp.exe"
  2⤵
  PID:5896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 340
    3⤵
    - Program crash
    PID:5960
- C:\Users\Admin\Documents\GuardFox\5Uq1RKNTYKodk4Tr75uN905h.exe
  "C:\Users\Admin\Documents\GuardFox\5Uq1RKNTYKodk4Tr75uN905h.exe"
  2⤵
  PID:5608
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4656
- C:\Users\Admin\Documents\GuardFox\YkKk7_BkZETyv0nr_t_YahKL.exe
  "C:\Users\Admin\Documents\GuardFox\YkKk7_BkZETyv0nr_t_YahKL.exe"
  2⤵
  PID:5656
- - C:\Users\Admin\Documents\GuardFox\K0icvbGRWAvQqwq5Yqt6eLAM.exe
    "C:\Users\Admin\Documents\GuardFox\K0icvbGRWAvQqwq5Yqt6eLAM.exe"
    3⤵
    PID:4840
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN K0icvbGRWAvQqwq5Yqt6eLAM.exe /TR "C:\Users\Admin\Documents\GuardFox\K0icvbGRWAvQqwq5Yqt6eLAM.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\1000113001\e0cbefcb1af40c7d4aff4aca26621a98.exe
      "C:\Users\Admin\AppData\Local\Temp\1000113001\e0cbefcb1af40c7d4aff4aca26621a98.exe"
      4⤵
      PID:228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 372
        5⤵
        Program crash
        
        PID:2392
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 392
        5⤵
        Program crash
        
        PID:5012
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 388
        5⤵
        Program crash
        
        PID:3996
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 680
        5⤵
        Program crash
        
        PID:5076
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 720
        5⤵
        Program crash
        
        PID:5496
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 720
        5⤵
        Program crash
        
        PID:5080
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 752
        5⤵
        Program crash
        
        PID:5672
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 760
        5⤵
        Program crash
        
        PID:4228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 768
        5⤵
        Program crash
        
        PID:3260
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 616
        5⤵
        Program crash
        
        PID:5820
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 816
        5⤵
        Program crash
        
        PID:4352
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 804
        5⤵
        Program crash
        
        PID:3900
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 620
        5⤵
        Program crash
        
        PID:5304
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 740
        5⤵
        Program crash
        
        PID:1936
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 704
        5⤵
        Program crash
        
        PID:2800
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 620
        5⤵
        Program crash
        
        PID:1080
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 752
        5⤵
        Program crash
        
        PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\1000114001\InstallSetup8.exe
      "C:\Users\Admin\AppData\Local\Temp\1000114001\InstallSetup8.exe"
      4⤵
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
        
        C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
        5⤵
        
        PID:5540
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
        6⤵
        
        PID:860
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        7⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        7⤵
        Creates scheduled task(s)
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\nskD0CA.tmp
        
        C:\Users\Admin\AppData\Local\Temp\nskD0CA.tmp
        5⤵
        
        PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\1000115001\toolspub1.exe
      "C:\Users\Admin\AppData\Local\Temp\1000115001\toolspub1.exe"
      4⤵
      PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\1000117001\rty27.exe
      "C:\Users\Admin\AppData\Local\Temp\1000117001\rty27.exe"
      4⤵
      PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\1000119001\FirstZ.exe
      "C:\Users\Admin\AppData\Local\Temp\1000119001\FirstZ.exe"
      4⤵
      PID:3752
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        5⤵
        
        PID:7188
- C:\Users\Admin\Documents\GuardFox\YGiX5AiY5BR0Pby2GPC3kkwO.exe
  "C:\Users\Admin\Documents\GuardFox\YGiX5AiY5BR0Pby2GPC3kkwO.exe"
  2⤵
  PID:5208
- C:\Users\Admin\Documents\GuardFox\afNzcOq949b3Bwa5JRJAT6D_.exe
  "C:\Users\Admin\Documents\GuardFox\afNzcOq949b3Bwa5JRJAT6D_.exe"
  2⤵
  PID:5220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2512
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4f869758,0x7ffa4f869768,0x7ffa4f869778
      4⤵
      PID:5852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1992,i,300433294424543661,16579993218369030579,131072 /prefetch:2
      4⤵
      PID:4556
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2648 --field-trial-handle=1992,i,300433294424543661,16579993218369030579,131072 /prefetch:1
      4⤵
      PID:4488
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2640 --field-trial-handle=1992,i,300433294424543661,16579993218369030579,131072 /prefetch:1
      4⤵
      PID:5444
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 --field-trial-handle=1992,i,300433294424543661,16579993218369030579,131072 /prefetch:8
      4⤵
      PID:4772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1916 --field-trial-handle=1992,i,300433294424543661,16579993218369030579,131072 /prefetch:8
      4⤵
      PID:4996
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4828 --field-trial-handle=1992,i,300433294424543661,16579993218369030579,131072 /prefetch:8
      4⤵
      PID:5180
- C:\Users\Admin\Documents\GuardFox\5zx0y6kSUPFku8tjkC0xQayH.exe
  "C:\Users\Admin\Documents\GuardFox\5zx0y6kSUPFku8tjkC0xQayH.exe"
  2⤵
  PID:1432
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    3⤵
    PID:2684
  - - C:\Users\Admin\Documents\GuardFox\qemu-ga.exe
      "C:\Users\Admin\Documents\GuardFox\qemu-ga.exe"
      4⤵
      PID:5800
- C:\Users\Admin\Documents\GuardFox\U0q1hfgRKMRFJgyiJDIqy4al.exe
  "C:\Users\Admin\Documents\GuardFox\U0q1hfgRKMRFJgyiJDIqy4al.exe"
  2⤵
  PID:5328
- C:\Users\Admin\Documents\GuardFox\3gqX3E5lYdPbhluIO4oc0lVn.exe
  "C:\Users\Admin\Documents\GuardFox\3gqX3E5lYdPbhluIO4oc0lVn.exe"
  2⤵
  PID:5320
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\dpFQW.CPL",
    3⤵
    PID:5904
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\dpFQW.CPL",
      4⤵
      PID:2680
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\dpFQW.CPL",
        5⤵
        
        PID:5264
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\dpFQW.CPL",
        6⤵
        
        PID:2600
- C:\Users\Admin\Documents\GuardFox\SogTFNgEWMjtDSRSopnxkAAM.exe
  "C:\Users\Admin\Documents\GuardFox\SogTFNgEWMjtDSRSopnxkAAM.exe"
  2⤵
  PID:5308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5896 -ip 5896
1⤵
PID:644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5280

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
1⤵
PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2828 -ip 2828
1⤵
PID:4436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4728

C:\Users\Admin\Documents\GuardFox\laqEkiUgQ7lgU1CF4SddhJTH.exe
"C:\Users\Admin\Documents\GuardFox\laqEkiUgQ7lgU1CF4SddhJTH.exe" --Admin IsNotAutoStart IsNotTask
1⤵
PID:1656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 568
  2⤵
  - Program crash
  PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1656 -ip 1656
1⤵
PID:5332

C:\Users\Admin\AppData\Local\Temp\B939.exe
C:\Users\Admin\AppData\Local\Temp\B939.exe
1⤵
PID:5864
- C:\Users\Admin\AppData\Local\Temp\B939.exe
  C:\Users\Admin\AppData\Local\Temp\B939.exe
  2⤵
  PID:4664

C:\Users\Admin\AppData\Local\Temp\C139.exe
C:\Users\Admin\AppData\Local\Temp\C139.exe
1⤵
PID:5968
- C:\Windows\SysWOW64\cmd.exe
  cmd /k cmd < Dot & exit
  2⤵
  PID:4224
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 228 -ip 228
1⤵
PID:5136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 228 -ip 228
1⤵
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 228 -ip 228
1⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 228 -ip 228
1⤵
PID:5432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 228 -ip 228
1⤵
PID:1484

C:\Users\Admin\AppData\Local\Temp\D0DA.exe
C:\Users\Admin\AppData\Local\Temp\D0DA.exe
1⤵
PID:5624
- C:\Users\Admin\AppData\Local\Temp\is-F6SKL.tmp\D0DA.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-F6SKL.tmp\D0DA.tmp" /SL5="$102C4,3501695,54272,C:\Users\Admin\AppData\Local\Temp\D0DA.exe"
  2⤵
  PID:5596

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 228 -ip 228
1⤵
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 228 -ip 228
1⤵
PID:5820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 228 -ip 228
1⤵
PID:5336

C:\Users\Admin\AppData\Local\Temp\EB58.exe
C:\Users\Admin\AppData\Local\Temp\EB58.exe
1⤵
PID:4588
- C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
  "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
  2⤵
  PID:656
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:10120
- C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
  2⤵
  PID:3596
- - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    3⤵
    PID:6136
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      PID:4836
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:4876
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        5⤵
        Creates scheduled task(s)
        
        PID:1692
- - C:\Users\Admin\AppData\Local\Temp\nsr1372.tmp
    C:\Users\Admin\AppData\Local\Temp\nsr1372.tmp
    3⤵
    PID:5332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 228 -ip 228
1⤵
PID:2348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5484 -ip 5484
1⤵
PID:5964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 228 -ip 228
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2396 -ip 2396
1⤵
PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 348
1⤵
- Program crash
PID:4836

C:\Users\Admin\AppData\Local\Temp\FBF3.exe
C:\Users\Admin\AppData\Local\Temp\FBF3.exe
1⤵
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 228 -ip 228
1⤵
PID:5720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 228 -ip 228
1⤵
PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 228 -ip 228
1⤵
PID:1820

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8F4.dll
1⤵
PID:5268
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8F4.dll
  2⤵
  PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 228 -ip 228
1⤵
PID:5300

C:\Users\Admin\AppData\Local\Temp\BE3.exe
C:\Users\Admin\AppData\Local\Temp\BE3.exe
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 228 -ip 228
1⤵
PID:1904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4324 -ip 4324
1⤵
PID:6116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 228 -ip 228
1⤵
PID:5272

C:\Users\Admin\AppData\Local\Temp\2CCA.exe
C:\Users\Admin\AppData\Local\Temp\2CCA.exe
1⤵
PID:2040

C:\Users\Admin\AppData\Roaming\gtuareb
C:\Users\Admin\AppData\Roaming\gtuareb
1⤵
PID:4772

C:\Users\Admin\Documents\GuardFox\K0icvbGRWAvQqwq5Yqt6eLAM.exe
C:\Users\Admin\Documents\GuardFox\K0icvbGRWAvQqwq5Yqt6eLAM.exe
1⤵
PID:5820

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
1⤵
PID:7128
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7128.0.655403251\429932774" -parentBuildID 20221007134813 -prefsHandle 1876 -prefMapHandle 1868 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa311934-eb75-40a8-821f-308c092992ad} 7128 "\\.\pipe\gecko-crash-server-pipe.7128" 1956 222f3fd6958 gpu
  2⤵
  PID:7276
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7128.1.1985002483\1419797318" -parentBuildID 20221007134813 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8f2d6a0-72df-4a9d-8b0a-3f5b3fcf5f1e} 7128 "\\.\pipe\gecko-crash-server-pipe.7128" 2432 222f3f04758 socket
  2⤵
  PID:4608
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7128.3.1522509349\1228387988" -childID 2 -isForBrowser -prefsHandle 3172 -prefMapHandle 3104 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1236 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a90d1f0-9741-4136-85f3-9ee47ae2be73} 7128 "\\.\pipe\gecko-crash-server-pipe.7128" 3136 222e7760758 tab
  2⤵
  PID:3224
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7128.2.1321588420\127988524" -childID 1 -isForBrowser -prefsHandle 3384 -prefMapHandle 3380 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1236 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f83e115d-9947-4b10-9563-0e6d0278a099} 7128 "\\.\pipe\gecko-crash-server-pipe.7128" 3396 222f3f5f858 tab
  2⤵
  PID:8956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7764

C:\Users\Admin\AppData\Local\Temp\6792.exe
C:\Users\Admin\AppData\Local\Temp\6792.exe
1⤵
PID:7920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 228 -ip 228
1⤵
PID:8172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5148 -ip 5148
1⤵
PID:6928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

T1222

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery