hxxps://filebin[.]net/3u1h74rhadibtil8

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000100000002a8b5-1432.dat	upx
behavioral1/files/0x000100000002a8b5-1433.dat	upx
behavioral1/memory/1192-1436-0x00007FFC84730000-0x00007FFC84D19000-memory.dmp	upx
behavioral1/files/0x000100000002a826-1438.dat	upx
behavioral1/files/0x000100000002a861-1443.dat	upx
behavioral1/memory/1192-1445-0x00007FFC99080000-0x00007FFC990A3000-memory.dmp	upx
behavioral1/files/0x000100000002a824-1448.dat	upx
behavioral1/memory/1192-1446-0x00007FFCA24E0000-0x00007FFCA24EF000-memory.dmp	upx
behavioral1/files/0x000100000002a82a-1450.dat	upx
behavioral1/memory/1192-1452-0x00007FFC99050000-0x00007FFC9907D000-memory.dmp	upx
behavioral1/files/0x000100000002a82d-1486.dat	upx
behavioral1/files/0x000100000002a82c-1485.dat	upx
behavioral1/files/0x000100000002a82b-1484.dat	upx
behavioral1/files/0x000100000002a829-1483.dat	upx
behavioral1/files/0x000100000002a828-1482.dat	upx
behavioral1/files/0x000100000002a827-1481.dat	upx
behavioral1/files/0x000100000002a825-1480.dat	upx
behavioral1/files/0x000100000002a823-1479.dat	upx
behavioral1/files/0x000100000002ad16-1478.dat	upx
behavioral1/files/0x000100000002ad07-1476.dat	upx
behavioral1/files/0x000100000002acab-1475.dat	upx
behavioral1/files/0x000100000002a947-1474.dat	upx
behavioral1/files/0x000100000002a946-1473.dat	upx
behavioral1/memory/1192-1488-0x00007FFC98F80000-0x00007FFC98F99000-memory.dmp	upx
behavioral1/memory/1192-1487-0x00007FFC87A60000-0x00007FFC87DD8000-memory.dmp	upx
behavioral1/files/0x000100000002a93c-1472.dat	upx
behavioral1/memory/1192-1489-0x00007FFCA1480000-0x00007FFCA148D000-memory.dmp	upx
behavioral1/files/0x000100000002a820-1471.dat	upx
behavioral1/memory/1192-1491-0x00007FFC85BA0000-0x00007FFC85C58000-memory.dmp	upx
behavioral1/memory/1192-1492-0x00007FFC9CBA0000-0x00007FFC9CBAD000-memory.dmp	upx
behavioral1/memory/1192-1493-0x00007FFC988B0000-0x00007FFC988D6000-memory.dmp	upx
behavioral1/memory/1192-1494-0x00007FFC85A80000-0x00007FFC85B9C000-memory.dmp	upx
behavioral1/memory/1192-1495-0x00007FFC93AC0000-0x00007FFC93AF8000-memory.dmp	upx
behavioral1/memory/1192-1496-0x00007FFC98F70000-0x00007FFC98F7B000-memory.dmp	upx
behavioral1/memory/1192-1490-0x00007FFC98ED0000-0x00007FFC98EFE000-memory.dmp	upx
behavioral1/files/0x000100000002a81f-1470.dat	upx
behavioral1/memory/1192-1498-0x00007FFC98E40000-0x00007FFC98E4C000-memory.dmp	upx
behavioral1/memory/1192-1497-0x00007FFC98F60000-0x00007FFC98F6B000-memory.dmp	upx
behavioral1/memory/1192-1499-0x00007FFC98BC0000-0x00007FFC98BCB000-memory.dmp	upx
behavioral1/memory/1192-1500-0x00007FFC98BB0000-0x00007FFC98BBC000-memory.dmp	upx
behavioral1/files/0x000100000002a81e-1469.dat	upx
behavioral1/files/0x000100000002a81d-1468.dat	upx
behavioral1/files/0x000100000002a88a-1467.dat	upx
behavioral1/files/0x000100000002a885-1466.dat	upx
behavioral1/memory/1192-1501-0x00007FFC981D0000-0x00007FFC981DB000-memory.dmp	upx
behavioral1/files/0x000100000002a86b-1465.dat	upx
behavioral1/files/0x000100000002a86a-1464.dat	upx
behavioral1/files/0x000100000002a869-1463.dat	upx
behavioral1/memory/1192-1502-0x00007FFC981C0000-0x00007FFC981CC000-memory.dmp	upx
behavioral1/files/0x000100000002a868-1462.dat	upx
behavioral1/memory/1192-1503-0x00007FFC97F30000-0x00007FFC97F3C000-memory.dmp	upx
behavioral1/files/0x000100000002a867-1461.dat	upx
behavioral1/files/0x000100000002a866-1460.dat	upx
behavioral1/files/0x000100000002a865-1459.dat	upx
behavioral1/memory/1192-1504-0x00007FFC97F20000-0x00007FFC97F2E000-memory.dmp	upx
behavioral1/files/0x000100000002a864-1458.dat	upx
behavioral1/files/0x000100000002a863-1457.dat	upx
behavioral1/memory/1192-1505-0x00007FFC93AB0000-0x00007FFC93ABC000-memory.dmp	upx
behavioral1/files/0x000100000002a862-1456.dat	upx
behavioral1/files/0x000100000002a860-1455.dat	upx
behavioral1/files/0x000100000002a859-1454.dat	upx
behavioral1/memory/1192-1449-0x00007FFC9EDF0000-0x00007FFC9EE09000-memory.dmp	upx
behavioral1/memory/1192-1506-0x00007FFC93AA0000-0x00007FFC93AAB000-memory.dmp	upx
behavioral1/memory/1192-1507-0x00007FFC91EE0000-0x00007FFC91EEB000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\valorant account checker = "C:\\Users\\Admin\\valorant account checker\\valorant account checker.exe"	valorant account checker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{b6178a40-1665-4565-b73e-48dd6e039a65} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{b6178a40-1665-4565-b73e-48dd6e039a65}\\python-3.12.2-amd64.exe\" /burn.runonce"	python-3.12.2-amd64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
332	discord.com
338	discord.com
341	discord.com
325	discord.com
326	discord.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF3E45842CDBD57CA8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF45AAAD0CC8EE2076.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF57BD44F868A0ED64.TMP	msiexec.exe
File created	C:\Windows\Installer\e68b74b.msi	msiexec.exe
File created	C:\Windows\Installer\e68b74f.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4534F2ED-1616-434D-98A6-0DA358DCD466}	msiexec.exe
File created	C:\Windows\Installer\e68b72c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF48276EB33D407E94.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC506.tmp	msiexec.exe
File created	C:\Windows\Installer\e68b746.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA6B4A3EB82A4A456.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e68b750.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDCD559DC48A0CD3E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFCFA8FEC967E395B.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBEEA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e68b737.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e68b741.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB97A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e68b72d.msi	msiexec.exe
File created	C:\Windows\Installer\e68b73b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID310.tmp	msiexec.exe
File created	C:\Windows\Installer\e68b740.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF97C13C31B0AB1184.TMP	msiexec.exe
File created	C:\Windows\Installer\e68b745.msi	msiexec.exe
File created	C:\Windows\Installer\e68b754.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF33510D98A13CBA7B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e68b732.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA04.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2FD8067BA2F51B54.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI17DF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI159B.tmp	msiexec.exe
File created	C:\Windows\Installer\e68b728.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e68b728.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEBFC465A674DE9D0.TMP	msiexec.exe
File created	C:\Windows\Installer\e68b737.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5544BA5BAFF5C612.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF28E43B811C0D54F0.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{94087C99-E4F5-4637-A789-3B6059DF787B}	msiexec.exe
File created	C:\Windows\Installer\e68b741.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEB48C9A7BA42FF83.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6E50F04D54FB9CA5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE8D1B90EB51D2BB7.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB7E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF19E4C2057DA3B5AA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5371733FFE06FFB1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2AA5BB0A10E350AB.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BDE73EDC-76AE-475D-8885-9B583631B0FC}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3E38CBDFACFDD1E9.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e68b746.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF21BF39980BBF70FB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e68b74b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI179F.tmp	msiexec.exe
File created	C:\Windows\Installer\e68b73c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD3B33C1E6E599F5C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF97168202E8D59A0C.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BD32BDE9-835D-4013-8F9A-45FF11456F02}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF11E1D74E20A88B7E.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB2A0682AD2B3CE57.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF63CB1F7087BEEBDA.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
5820	1584	WerFault.exe	134
4692	5912	WerFault.exe	152
6392	6992	WerFault.exe	175
6304	6904	WerFault.exe	179
6844	508	WerFault.exe	202

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4816	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133558677095646932"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\{BDE73EDC-76AE-475D-8885-9B583631B0FC}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\.pyz	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.NoConArchiveFile	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}\Dependents	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.File\Shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\.pyzw	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.CompiledFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.CompiledFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\.pyzw\Content Type = "application/x-zip-compressed"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.File\Shell\editwithidle\shell\edit312\MUIVerb = "Edit with IDLE 3.12 (64-bit)"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.File\Shell\editwithidle\shell\edit312\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Python312\\pythonw.exe\" -m idlelib \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\.py\ = "Python.File"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.NoConFile\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\pyw.exe\" \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.ArchiveFile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\" \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.NoConArchiveFile\ = "Python Zip Application File (no console)"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\.pyc\ = "Python.CompiledFile"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}\ = "{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.NoConFile\Shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.NoConFile\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.Extension\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\.pyz\Content Type = "application/x-zip-compressed"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\ = "{4534F2ED-1616-434D-98A6-0DA358DCD466}"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.ArchiveFile\shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.NoConArchiveFile\shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\DisplayName = "Python 3.12.2 Core Interpreter (64-bit)"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.NoConFile	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.CompiledFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.File	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.ArchiveFile	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.File\Shell\editwithidle\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.File\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\CPython-3.12\DisplayName = "Python 3.12.2 (64-bit)"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}\Dependents	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.CompiledFile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\" \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.CompiledFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",2"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}\DisplayName = "Python 3.12.2 Development Libraries (64-bit)"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Python312\\pythonw.exe\" -m idlelib \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.File\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\.py\Content Type = "text/x-python"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\.pyw\ = "Python.NoConFile"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.ArchiveFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}\Dependents	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.NoConFile\Shell\editwithidle\MUIVerb = "&Edit with IDLE"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.NoConArchiveFile\DefaultIcon	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\{B50C92E9-2780-433A-AA61-E9F06D0AFF8A}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.File\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\" \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\.pyw	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\{94087C99-E4F5-4637-A789-3B6059DF787B}\Dependents	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\{BDE73EDC-76AE-475D-8885-9B583631B0FC}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.NoConArchiveFile\shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Python.NoConArchiveFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Installer\Dependencies\{BD32BDE9-835D-4013-8F9A-45FF11456F02}\ = "{BD32BDE9-835D-4013-8F9A-45FF11456F02}"	python-3.12.2-amd64.exe

NTFS ADS 11 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\e66337b\winzip28-downwz-p024.exe\:Zone.Identifier:$DATA	winzip28-downwz-p024.exe
File created	C:\Users\Admin\AppData\Local\Temp\e6801a3\winzip28-downwz-p024.exe\:Zone.Identifier:$DATA	winzip28-downwz-p024.exe
File created	C:\Users\Admin\Downloads\winzip28-downwz-p024.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\AppData\Local\Temp\e62d173\winzip28-downwz-p024.exe\:Zone.Identifier:$DATA	winzip28-downwz-p024.exe
File created	C:\Users\Admin\AppData\Local\Temp\e63a7de\winzip28-downwz-p024.exe\:Zone.Identifier:$DATA	winzip28-downwz-p024.exe
File created	C:\Users\Admin\AppData\Local\Temp\e658a79\winzip28-downwz-p024.exe\:Zone.Identifier:$DATA	winzip28-downwz-p024.exe
File created	C:\Users\Admin\Downloads\winzip28-downwz-p024(1).exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\python-3.12.2-amd64.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\AppData\Local\Temp\e67aa1d\winzip28-downwz-p024.exe\:Zone.Identifier:$DATA	winzip28-downwz-p024.exe
File created	C:\Users\Admin\AppData\Local\Temp\e6a614e\winzip28-downwz-p024.exe\:Zone.Identifier:$DATA	winzip28-downwz-p024.exe
File opened for modification	C:\Users\Admin\Downloads\valorant_account_checker.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
808	chrome.exe
808	chrome.exe
1192	valorant account checker.exe
1192	valorant account checker.exe
1192	valorant account checker.exe
1192	valorant account checker.exe
1192	valorant account checker.exe
1192	valorant account checker.exe
1192	valorant account checker.exe
1192	valorant account checker.exe
1468	powershell.exe
1468	powershell.exe
236	msedge.exe
236	msedge.exe
1076	msedge.exe
1076	msedge.exe
5476	identity_helper.exe
5476	identity_helper.exe
6000	msedge.exe
6000	msedge.exe
5596	msiexec.exe
5596	msiexec.exe
5596	msiexec.exe
5596	msiexec.exe
5596	msiexec.exe
5596	msiexec.exe
5596	msiexec.exe
5596	msiexec.exe
5596	msiexec.exe
5596	msiexec.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
5596	msiexec.exe
5596	msiexec.exe
5596	msiexec.exe
5596	msiexec.exe
5596	msiexec.exe
5596	msiexec.exe
5596	msiexec.exe
5596	msiexec.exe
7012	valorant account checker.exe
7012	valorant account checker.exe
7012	valorant account checker.exe
7012	valorant account checker.exe
7012	valorant account checker.exe
7012	valorant account checker.exe
7012	valorant account checker.exe
7012	valorant account checker.exe
7092	powershell.exe
7092	powershell.exe
7092	powershell.exe
2168	valorant account checker.exe
2168	valorant account checker.exe
2168	valorant account checker.exe
2168	valorant account checker.exe
2168	valorant account checker.exe
2168	valorant account checker.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
7012	valorant account checker.exe
2168	valorant account checker.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of SetWindowsHookEx 40 IoCs

pid	Process
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2920	winzip28-downwz-p024.exe
1584	winzip28-downwz-p024.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
5696	winzip28-downwz-p024.exe
5708	winzip28-downwz-p024.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
5976	winzip28-downwz-p024.exe
5716	winzip28-downwz-p024.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
4036	winzip28-downwz-p024.exe
5912	winzip28-downwz-p024.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
6964	winzip28-downwz-p024.exe
6992	winzip28-downwz-p024.exe
2920	winzip28-downwz-p024.exe
6904	winzip28-downwz-p024.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
6304	winzip28-downwz-p024.exe
508	winzip28-downwz-p024.exe
7012	valorant account checker.exe
2168	valorant account checker.exe
9784	valorant account checker.exe
6228	valorant account checker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 112	2944	chrome.exe	79
PID 2944 wrote to memory of 112	2944	chrome.exe	79
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 4216	2944	chrome.exe	82
PID 2944 wrote to memory of 3392	2944	chrome.exe	83
PID 2944 wrote to memory of 3392	2944	chrome.exe	83
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84
PID 2944 wrote to memory of 3732	2944	chrome.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
728	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://filebin.net/3u1h74rhadibtil8
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffc99ae9758,0x7ffc99ae9768,0x7ffc99ae9778
  2⤵
  PID:112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:2
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2140 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:1
  2⤵
  PID:688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=748 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4020 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4920 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5156 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5472 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3784 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:1
  2⤵
  PID:500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5272 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5668 --field-trial-handle=1848,i,8839256577966733223,1829512601160242195,131072 /prefetch:1
  2⤵
  PID:4468

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1308

C:\Users\Admin\AppData\Local\Temp\Temp1_valorant_account_checker.zip\valorant account checker.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_valorant_account_checker.zip\valorant account checker.exe"
1⤵
PID:2580
- C:\Users\Admin\AppData\Local\Temp\Temp1_valorant_account_checker.zip\valorant account checker.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_valorant_account_checker.zip\valorant account checker.exe"
  2⤵
  - Enumerates VirtualBox DLL files
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:1192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\valorant account checker\""
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\valorant account checker\activate.bat""
    3⤵
    PID:3556
  - - C:\Windows\system32\attrib.exe
      attrib +s +h .
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:728
  - - C:\Users\Admin\valorant account checker\valorant account checker.exe
      "valorant account checker.exe"
      4⤵
      Executes dropped EXE
      PID:1476
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "valorant account checker.exe"
      4⤵
      Kills process with taskkill
      PID:4816

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C0
1⤵
PID:3220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4784
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.0.1753211491\728524582" -parentBuildID 20221007134813 -prefsHandle 1796 -prefMapHandle 1788 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {36cea336-3035-48bc-9cbd-254f34e37f58} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 1892 1c87fcd2458 gpu
    3⤵
    PID:3608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.1.559086573\810494095" -parentBuildID 20221007134813 -prefsHandle 2268 -prefMapHandle 2264 -prefsLen 20783 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78d5fca4-2efa-48d1-96f5-94e062bce9ee} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 2280 1c87fc03e58 socket
    3⤵
    PID:1124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.2.2092041445\611694915" -childID 1 -isForBrowser -prefsHandle 2728 -prefMapHandle 2860 -prefsLen 20821 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {941d01de-d81e-4078-a7f3-2927b55b5811} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 3160 1c87fc5a658 tab
    3⤵
    PID:4872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.3.359314573\1804553789" -childID 2 -isForBrowser -prefsHandle 3432 -prefMapHandle 3428 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c753ea2-9a5a-4027-bc63-10157612d870} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 952 1c80f60e658 tab
    3⤵
    PID:2180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.4.438341096\773243062" -childID 3 -isForBrowser -prefsHandle 4492 -prefMapHandle 4488 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a52774d-1e6b-4a2a-9a3e-b9060a42575d} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4512 1c8105f7b58 tab
    3⤵
    PID:428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.5.899697275\1840883154" -childID 4 -isForBrowser -prefsHandle 5000 -prefMapHandle 4952 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0cbcda4-d916-4f94-8cd6-b4b6a114d015} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4968 1c8105f6658 tab
    3⤵
    PID:3032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.6.1171614256\773559588" -childID 5 -isForBrowser -prefsHandle 4964 -prefMapHandle 5032 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c69ec296-1d63-4ecb-a40d-27b761359ef1} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4348 1c810aecb58 tab
    3⤵
    PID:4512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.7.251084098\996266673" -childID 6 -isForBrowser -prefsHandle 5328 -prefMapHandle 5336 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b911036-3c3b-4d3c-96d4-f1c958e6506c} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 5316 1c810aefe58 tab
    3⤵
    PID:3292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.8.791643285\53844721" -childID 7 -isForBrowser -prefsHandle 5856 -prefMapHandle 5860 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {941f9abf-d7d5-4d58-8f52-c5a4bcf9c489} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 5848 1c8126a9758 tab
    3⤵
    PID:2516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.9.468406771\1147934113" -childID 8 -isForBrowser -prefsHandle 4748 -prefMapHandle 4688 -prefsLen 26723 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6177d5a-6346-40a4-bea8-1a1489d65cec} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 1648 1c8121b2b58 tab
    3⤵
    PID:1068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.10.2126241811\843326244" -childID 9 -isForBrowser -prefsHandle 3208 -prefMapHandle 6124 -prefsLen 26723 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9db40447-bba3-46a1-a27d-4d49a189971e} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 6120 1c81072c958 tab
    3⤵
    PID:3384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.11.1270514211\1781196078" -childID 10 -isForBrowser -prefsHandle 5576 -prefMapHandle 4508 -prefsLen 26732 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {636e7f0c-a3dd-4f01-bbc6-25afd28b00aa} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 5228 1c812a11c58 tab
    3⤵
    PID:2488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.12.1819757500\664033426" -childID 11 -isForBrowser -prefsHandle 4172 -prefMapHandle 4980 -prefsLen 26732 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1e94691-6365-4ad1-bc3b-6bf3d3ff7121} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 1640 1c812d84658 tab
    3⤵
    PID:3496
- - C:\Users\Admin\Downloads\winzip28-downwz-p024.exe
    "C:\Users\Admin\Downloads\winzip28-downwz-p024.exe"
    3⤵
    - Executes dropped EXE
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\e62d173\winzip28-downwz-p024.exe
      run=1 shortcut="C:\Users\Admin\Downloads\winzip28-downwz-p024.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1584
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 2120
        5⤵
        Program crash
        
        PID:5820
- - C:\Users\Admin\Downloads\winzip28-downwz-p024.exe
    "C:\Users\Admin\Downloads\winzip28-downwz-p024.exe"
    3⤵
    - Executes dropped EXE
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\e63a7de\winzip28-downwz-p024.exe
      run=1 shortcut="C:\Users\Admin\Downloads\winzip28-downwz-p024.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.13.564796510\930488962" -childID 12 -isForBrowser -prefsHandle 7476 -prefMapHandle 1484 -prefsLen 27528 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f8bd1c6-2e17-457e-b4b7-3eacbb140386} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4704 1c812a10758 tab
    3⤵
    PID:2124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.14.1412900814\185817254" -childID 13 -isForBrowser -prefsHandle 6540 -prefMapHandle 6544 -prefsLen 27528 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b0e7558-328b-43b7-a903-6ffdae81a259} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 6360 1c812a12858 tab
    3⤵
    PID:5272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.15.1243261303\1283159953" -childID 14 -isForBrowser -prefsHandle 6480 -prefMapHandle 6468 -prefsLen 27528 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0cd2055-6089-4ccc-9bd7-012258e998ac} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 6504 1c812a12b58 tab
    3⤵
    PID:5252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.16.1761470504\462931645" -childID 15 -isForBrowser -prefsHandle 8048 -prefMapHandle 8044 -prefsLen 27528 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd68ea35-d613-4680-b220-076245802d69} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 8056 1c816064558 tab
    3⤵
    PID:5300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.17.1719047761\2103741464" -childID 16 -isForBrowser -prefsHandle 8196 -prefMapHandle 8200 -prefsLen 27528 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {844b45d8-d565-4c98-93a4-629828a60719} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 8188 1c81667b258 tab
    3⤵
    PID:5516
- - C:\Users\Admin\Downloads\winzip28-downwz-p024.exe
    "C:\Users\Admin\Downloads\winzip28-downwz-p024.exe"
    3⤵
    - Executes dropped EXE
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\e658a79\winzip28-downwz-p024.exe
      run=1 shortcut="C:\Users\Admin\Downloads\winzip28-downwz-p024.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5716
- - C:\Users\Admin\Downloads\winzip28-downwz-p024.exe
    "C:\Users\Admin\Downloads\winzip28-downwz-p024.exe"
    3⤵
    - Executes dropped EXE
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\e66337b\winzip28-downwz-p024.exe
      run=1 shortcut="C:\Users\Admin\Downloads\winzip28-downwz-p024.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5912
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 1932
        5⤵
        Program crash
        
        PID:4692
- - C:\Users\Admin\Downloads\python-3.12.2-amd64.exe
    "C:\Users\Admin\Downloads\python-3.12.2-amd64.exe"
    3⤵
    - Executes dropped EXE
    PID:5320
  - - C:\Windows\Temp\{32B35DC9-BEFD-441F-9B39-AE87EFF6D233}\.cr\python-3.12.2-amd64.exe
      "C:\Windows\Temp\{32B35DC9-BEFD-441F-9B39-AE87EFF6D233}\.cr\python-3.12.2-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.2-amd64.exe" -burn.filehandle.attached=580 -burn.filehandle.self=588
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      PID:5176
    - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe" -c "import winreg; winreg.SetValueEx(winreg.CreateKey(winreg.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\FileSystem'), 'LongPathsEnabled', None, winreg.REG_DWORD, 1)"
        5⤵
        Executes dropped EXE
        
        PID:6412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1584 -ip 1584
1⤵
PID:5796

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\235e652ee0ce4e3496e11660a7c060f8 /t 5720 /p 5708
1⤵
PID:592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5912 -ip 5912
1⤵
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winzip.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc85be3cb8,0x7ffc85be3cc8,0x7ffc85be3cd8
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,13922421432397873396,15474297116317044984,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,13922421432397873396,15474297116317044984,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,13922421432397873396,15474297116317044984,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,13922421432397873396,15474297116317044984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,13922421432397873396,15474297116317044984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,13922421432397873396,15474297116317044984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,13922421432397873396,15474297116317044984,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,13922421432397873396,15474297116317044984,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,13922421432397873396,15474297116317044984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:6256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,13922421432397873396,15474297116317044984,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:6264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,13922421432397873396,15474297116317044984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:6480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,13922421432397873396,15474297116317044984,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:6488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,13922421432397873396,15474297116317044984,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3108

C:\Users\Admin\Downloads\winzip28-downwz-p024.exe
"C:\Users\Admin\Downloads\winzip28-downwz-p024.exe"
1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6964
- C:\Users\Admin\AppData\Local\Temp\e67aa1d\winzip28-downwz-p024.exe
  run=1 shortcut="C:\Users\Admin\Downloads\winzip28-downwz-p024.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6992 -s 1964
    3⤵
    - Program crash
    PID:6392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6992 -ip 6992
1⤵
PID:6328

C:\Users\Admin\Downloads\winzip28-downwz-p024.exe
"C:\Users\Admin\Downloads\winzip28-downwz-p024.exe"
1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2920
- C:\Users\Admin\AppData\Local\Temp\e6801a3\winzip28-downwz-p024.exe
  run=1 shortcut="C:\Users\Admin\Downloads\winzip28-downwz-p024.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6904 -s 1956
    3⤵
    - Program crash
    PID:6304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 6904 -ip 6904
1⤵
PID:6288

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5596
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FD5CB8BAE3478417CF794FBF5B84869D
  2⤵
  PID:3284
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    PID:6272
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp56w627pu\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp56w627pu', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      PID:2300

C:\Users\Admin\Downloads\winzip28-downwz-p024.exe
"C:\Users\Admin\Downloads\winzip28-downwz-p024.exe"
1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6304
- C:\Users\Admin\AppData\Local\Temp\e6a614e\winzip28-downwz-p024.exe
  run=1 shortcut="C:\Users\Admin\Downloads\winzip28-downwz-p024.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 1964
    3⤵
    - Program crash
    PID:6844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 508 -ip 508
1⤵
PID:6900

C:\Users\Admin\Downloads\valorant_account_checker\valorant account checker.exe
"C:\Users\Admin\Downloads\valorant_account_checker\valorant account checker.exe"
1⤵
PID:6376
- C:\Users\Admin\Downloads\valorant_account_checker\valorant account checker.exe
  "C:\Users\Admin\Downloads\valorant_account_checker\valorant account checker.exe"
  2⤵
  - Enumerates VirtualBox DLL files
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:7012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\valorant account checker\""
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:7092

C:\Users\Admin\Downloads\valorant_account_checker\valorant account checker.exe
"C:\Users\Admin\Downloads\valorant_account_checker\valorant account checker.exe"
1⤵
PID:7040
- C:\Users\Admin\Downloads\valorant_account_checker\valorant account checker.exe
  "C:\Users\Admin\Downloads\valorant_account_checker\valorant account checker.exe"
  2⤵
  - Enumerates VirtualBox DLL files
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\valorant account checker\""
    3⤵
    PID:1296

C:\Users\Admin\Downloads\valorant_account_checker\valorant account checker.exe
"C:\Users\Admin\Downloads\valorant_account_checker\valorant account checker.exe"
1⤵
PID:6152
- C:\Users\Admin\Downloads\valorant_account_checker\valorant account checker.exe
  "C:\Users\Admin\Downloads\valorant_account_checker\valorant account checker.exe"
  2⤵
  - Enumerates VirtualBox DLL files
  - Suspicious use of SetWindowsHookEx
  PID:9784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:9876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\valorant account checker\""
    3⤵
    PID:6280

C:\Users\Admin\Downloads\valorant_account_checker\valorant account checker.exe
"C:\Users\Admin\Downloads\valorant_account_checker\valorant account checker.exe"
1⤵
PID:7952
- C:\Users\Admin\Downloads\valorant_account_checker\valorant account checker.exe
  "C:\Users\Admin\Downloads\valorant_account_checker\valorant account checker.exe"
  2⤵
  - Enumerates VirtualBox DLL files
  - Suspicious use of SetWindowsHookEx
  PID:6228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:9304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\valorant account checker\""
    3⤵
    PID:7512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery