strrat | 4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	x.exe

Blocklisted process makes network request 33 IoCs

flow	pid	Process
5	2948	wscript.exe
7	2948	wscript.exe
9	2468	powershell.exe
10	2468	powershell.exe
11	2948	wscript.exe
12	2948	wscript.exe
13	2948	wscript.exe
15	2948	wscript.exe
16	2948	wscript.exe
18	2948	wscript.exe
19	2948	wscript.exe
20	2948	wscript.exe
22	2948	wscript.exe
23	2948	wscript.exe
24	2948	wscript.exe
26	2948	wscript.exe
34	2948	wscript.exe
35	2948	wscript.exe
37	2948	wscript.exe
38	2948	wscript.exe
39	2948	wscript.exe
40	2948	wscript.exe
42	2948	wscript.exe
43	2948	wscript.exe
44	2948	wscript.exe
46	2948	wscript.exe
47	2948	wscript.exe
48	2948	wscript.exe
50	2948	wscript.exe
51	2948	wscript.exe
57	2948	wscript.exe
58	2948	wscript.exe
59	2948	wscript.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	x.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	x.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Service Executable.JS	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Service Executable.JS	wscript.exe

Executes dropped EXE 51 IoCs

pid	Process
2420	EmbraTor Mac Smash Bullet.exe
1252	x.exe
2376	CL_Debug_Log.txt
2972	Helper.exe
2100	Helper.exe
2260	Helper.exe
2868	Helper.exe
760	Helper.exe
2892	Helper.exe
2484	Helper.exe
2572	Helper.exe
2708	Helper.exe
1824	Helper.exe
1584	Helper.exe
2936	Helper.exe
988	Helper.exe
1688	Helper.exe
2944	Helper.exe
436	Helper.exe
2612	Helper.exe
2400	Helper.exe
3064	Helper.exe
2296	Helper.exe
3012	Helper.exe
2716	Helper.exe
2564	Helper.exe
2696	Helper.exe
2748	Helper.exe
1976	Helper.exe
1320	Helper.exe
960	Helper.exe
2936	Helper.exe
2176	Helper.exe
2208	Helper.exe
1652	Helper.exe
1996	Helper.exe
2148	Helper.exe
2980	Helper.exe
2112	Helper.exe
2704	Helper.exe
1488	Helper.exe
2072	Helper.exe
1016	Helper.exe
2532	Helper.exe
2460	Helper.exe
2144	Helper.exe
2420	Helper.exe
1584	Helper.exe
1300	Helper.exe
2884	Helper.exe
1040	tor.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Wine	x.exe

Loads dropped DLL 14 IoCs

pid	Process
1760	14052163e50c197697c64b143.exe
1760	14052163e50c197697c64b143.exe
2752	WScript.exe
1252	x.exe
2776	taskeng.exe
2236	Process not Found
2484	Helper.exe
2484	Helper.exe
1040	tor.exe
1040	tor.exe
1040	tor.exe
1040	tor.exe
1040	tor.exe
1040	tor.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Antimalware Service Executable = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Antimalware Service Executable.JS\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Antimalware Service Executable = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Antimalware Service Executable.JS\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Antimalware Service Executable = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Antimalware Service Executable.JS\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Antimalware Service Executable = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Antimalware Service Executable.JS\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

AutoIT Executable 11 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1252-55-0x0000000000EE0000-0x0000000002106000-memory.dmp	autoit_exe
behavioral1/memory/1252-82-0x0000000000EE0000-0x0000000002106000-memory.dmp	autoit_exe
behavioral1/memory/1252-77-0x0000000000EE0000-0x0000000002106000-memory.dmp	autoit_exe
behavioral1/files/0x0006000000016d89-86.dat	autoit_exe
behavioral1/memory/1252-94-0x0000000000EE0000-0x0000000002106000-memory.dmp	autoit_exe
behavioral1/files/0x0006000000016d84-91.dat	autoit_exe
behavioral1/files/0x000600000001704f-100.dat	autoit_exe
behavioral1/files/0x000600000001704f-103.dat	autoit_exe
behavioral1/files/0x000600000001704f-106.dat	autoit_exe
behavioral1/files/0x000600000001704f-131.dat	autoit_exe
behavioral1/files/0x000600000001704f-132.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2484 set thread context of 1016	2484	Helper.exe	180

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
1400	schtasks.exe

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
1580	timeout.exe
2964	timeout.exe
2312	timeout.exe
952	timeout.exe
1456	timeout.exe
2740	timeout.exe
2300	timeout.exe
188	timeout.exe
2960	timeout.exe
2604	timeout.exe
2452	timeout.exe
608	timeout.exe
1652	timeout.exe
2528	timeout.exe
2944	timeout.exe
764	timeout.exe
2572	timeout.exe
2116	timeout.exe
2852	timeout.exe
2032	timeout.exe
1100	timeout.exe
1508	timeout.exe
3000	timeout.exe
2684	timeout.exe
1976	timeout.exe
2084	timeout.exe
1624	timeout.exe
1476	timeout.exe
2104	timeout.exe
968	timeout.exe
2416	timeout.exe
2924	timeout.exe
1316	timeout.exe
1616	timeout.exe
432	timeout.exe
2932	timeout.exe
2804	timeout.exe
2688	timeout.exe
528	timeout.exe
608	timeout.exe
1932	timeout.exe
436	timeout.exe
952	timeout.exe
1100	timeout.exe
1560	timeout.exe
920	timeout.exe
2136	timeout.exe
3060	timeout.exe
700	timeout.exe
1016	timeout.exe
1300	timeout.exe
2256	timeout.exe
3012	timeout.exe
1928	timeout.exe
1932	timeout.exe
956	timeout.exe
2872	timeout.exe
1232	timeout.exe
2876	timeout.exe
2464	timeout.exe
2784	timeout.exe
2828	timeout.exe
772	timeout.exe
2472	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2468	powershell.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeRestorePrivilege	2376	CL_Debug_Log.txt
Token: 35	2376	CL_Debug_Log.txt
Token: SeSecurityPrivilege	2376	CL_Debug_Log.txt
Token: SeSecurityPrivilege	2376	CL_Debug_Log.txt
Token: SeRestorePrivilege	1016	Helper.exe
Token: 35	1016	Helper.exe
Token: SeSecurityPrivilege	1016	Helper.exe
Token: SeSecurityPrivilege	1016	Helper.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1252	x.exe
1252	x.exe
1252	x.exe
2972	Helper.exe
2972	Helper.exe
2972	Helper.exe
2100	Helper.exe
2100	Helper.exe
2972	Helper.exe
2100	Helper.exe
2100	Helper.exe
2260	Helper.exe
2260	Helper.exe
2260	Helper.exe
2260	Helper.exe
2868	Helper.exe
2868	Helper.exe
2868	Helper.exe
2868	Helper.exe
2892	Helper.exe
2892	Helper.exe
2892	Helper.exe
2892	Helper.exe
760	Helper.exe
760	Helper.exe
760	Helper.exe
760	Helper.exe
2572	Helper.exe
2572	Helper.exe
2572	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
1824	Helper.exe
2708	Helper.exe
2708	Helper.exe
2708	Helper.exe
1824	Helper.exe
1824	Helper.exe
1824	Helper.exe
2936	Helper.exe
2936	Helper.exe
2936	Helper.exe
1584	Helper.exe
2936	Helper.exe
1584	Helper.exe
1584	Helper.exe
1584	Helper.exe
988	Helper.exe
988	Helper.exe
988	Helper.exe
988	Helper.exe
1688	Helper.exe
1688	Helper.exe
1688	Helper.exe
436	Helper.exe
2944	Helper.exe
2944	Helper.exe
2944	Helper.exe
436	Helper.exe
436	Helper.exe
2612	Helper.exe
2612	Helper.exe
2612	Helper.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1252	x.exe
1252	x.exe
1252	x.exe
2972	Helper.exe
2972	Helper.exe
2972	Helper.exe
2100	Helper.exe
2100	Helper.exe
2972	Helper.exe
2100	Helper.exe
2100	Helper.exe
2260	Helper.exe
2260	Helper.exe
2260	Helper.exe
2260	Helper.exe
2868	Helper.exe
2868	Helper.exe
2868	Helper.exe
2868	Helper.exe
2892	Helper.exe
2892	Helper.exe
2892	Helper.exe
2892	Helper.exe
760	Helper.exe
760	Helper.exe
760	Helper.exe
760	Helper.exe
2572	Helper.exe
2572	Helper.exe
2572	Helper.exe
2484	Helper.exe
2484	Helper.exe
2484	Helper.exe
1824	Helper.exe
2708	Helper.exe
2708	Helper.exe
2708	Helper.exe
1824	Helper.exe
1824	Helper.exe
1824	Helper.exe
2936	Helper.exe
2936	Helper.exe
2936	Helper.exe
1584	Helper.exe
2936	Helper.exe
1584	Helper.exe
1584	Helper.exe
1584	Helper.exe
988	Helper.exe
988	Helper.exe
988	Helper.exe
988	Helper.exe
1688	Helper.exe
1688	Helper.exe
1688	Helper.exe
436	Helper.exe
2944	Helper.exe
2944	Helper.exe
2944	Helper.exe
436	Helper.exe
436	Helper.exe
2612	Helper.exe
2612	Helper.exe
2612	Helper.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2420	EmbraTor Mac Smash Bullet.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2712	1760	14052163e50c197697c64b143.exe	28
PID 1760 wrote to memory of 2712	1760	14052163e50c197697c64b143.exe	28
PID 1760 wrote to memory of 2712	1760	14052163e50c197697c64b143.exe	28
PID 1760 wrote to memory of 2712	1760	14052163e50c197697c64b143.exe	28
PID 1760 wrote to memory of 2752	1760	14052163e50c197697c64b143.exe	29
PID 1760 wrote to memory of 2752	1760	14052163e50c197697c64b143.exe	29
PID 1760 wrote to memory of 2752	1760	14052163e50c197697c64b143.exe	29
PID 1760 wrote to memory of 2752	1760	14052163e50c197697c64b143.exe	29
PID 1760 wrote to memory of 2552	1760	14052163e50c197697c64b143.exe	30
PID 1760 wrote to memory of 2552	1760	14052163e50c197697c64b143.exe	30
PID 1760 wrote to memory of 2552	1760	14052163e50c197697c64b143.exe	30
PID 1760 wrote to memory of 2552	1760	14052163e50c197697c64b143.exe	30
PID 1760 wrote to memory of 2456	1760	14052163e50c197697c64b143.exe	31
PID 1760 wrote to memory of 2456	1760	14052163e50c197697c64b143.exe	31
PID 1760 wrote to memory of 2456	1760	14052163e50c197697c64b143.exe	31
PID 1760 wrote to memory of 2456	1760	14052163e50c197697c64b143.exe	31
PID 2552 wrote to memory of 2468	2552	WScript.exe	32
PID 2552 wrote to memory of 2468	2552	WScript.exe	32
PID 2552 wrote to memory of 2468	2552	WScript.exe	32
PID 2552 wrote to memory of 2468	2552	WScript.exe	32
PID 1760 wrote to memory of 2420	1760	14052163e50c197697c64b143.exe	34
PID 1760 wrote to memory of 2420	1760	14052163e50c197697c64b143.exe	34
PID 1760 wrote to memory of 2420	1760	14052163e50c197697c64b143.exe	34
PID 1760 wrote to memory of 2420	1760	14052163e50c197697c64b143.exe	34
PID 2712 wrote to memory of 2948	2712	WScript.exe	35
PID 2712 wrote to memory of 2948	2712	WScript.exe	35
PID 2712 wrote to memory of 2948	2712	WScript.exe	35
PID 2712 wrote to memory of 2948	2712	WScript.exe	35
PID 2752 wrote to memory of 1252	2752	WScript.exe	37
PID 2752 wrote to memory of 1252	2752	WScript.exe	37
PID 2752 wrote to memory of 1252	2752	WScript.exe	37
PID 2752 wrote to memory of 1252	2752	WScript.exe	37
PID 1252 wrote to memory of 2376	1252	x.exe	38
PID 1252 wrote to memory of 2376	1252	x.exe	38
PID 1252 wrote to memory of 2376	1252	x.exe	38
PID 1252 wrote to memory of 2376	1252	x.exe	38
PID 1252 wrote to memory of 1516	1252	x.exe	43
PID 1252 wrote to memory of 1516	1252	x.exe	43
PID 1252 wrote to memory of 1516	1252	x.exe	43
PID 1252 wrote to memory of 1516	1252	x.exe	43
PID 1516 wrote to memory of 1400	1516	cmd.exe	45
PID 1516 wrote to memory of 1400	1516	cmd.exe	45
PID 1516 wrote to memory of 1400	1516	cmd.exe	45
PID 1516 wrote to memory of 1400	1516	cmd.exe	45
PID 1252 wrote to memory of 2348	1252	x.exe	47
PID 1252 wrote to memory of 2348	1252	x.exe	47
PID 1252 wrote to memory of 2348	1252	x.exe	47
PID 1252 wrote to memory of 2348	1252	x.exe	47
PID 2348 wrote to memory of 3024	2348	cmd.exe	97
PID 2348 wrote to memory of 3024	2348	cmd.exe	97
PID 2348 wrote to memory of 3024	2348	cmd.exe	97
PID 2348 wrote to memory of 3024	2348	cmd.exe	97
PID 2348 wrote to memory of 2528	2348	cmd.exe	99
PID 2348 wrote to memory of 2528	2348	cmd.exe	99
PID 2348 wrote to memory of 2528	2348	cmd.exe	99
PID 2348 wrote to memory of 2528	2348	cmd.exe	99
PID 2348 wrote to memory of 2740	2348	cmd.exe	150
PID 2348 wrote to memory of 2740	2348	cmd.exe	150
PID 2348 wrote to memory of 2740	2348	cmd.exe	150
PID 2348 wrote to memory of 2740	2348	cmd.exe	150
PID 2348 wrote to memory of 2524	2348	cmd.exe	152
PID 2348 wrote to memory of 2524	2348	cmd.exe	152
PID 2348 wrote to memory of 2524	2348	cmd.exe	152
PID 2348 wrote to memory of 2524	2348	cmd.exe	152

C:\Users\Admin\AppData\Local\Temp\14052163e50c197697c64b143.exe
"C:\Users\Admin\AppData\Local\Temp\14052163e50c197697c64b143.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Antimalware Service Executable.JS"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.JS"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    PID:2948
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MsMpEng.js"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Users\Admin\AppData\Local\Temp\x.exe
    "C:\Users\Admin\AppData\Local\Temp\x.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
      C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2376
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1516
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
        5⤵
        Creates scheduled task(s)
        
        PID:1400
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\x.exe"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\x.exe" exit)
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2348
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:3024
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2528
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2740
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2524
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:956
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2568
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2444
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2416
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2572
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2944
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1796
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1772
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1384
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:3044
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1580
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2576
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1624
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2300
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1616
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2872
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1844
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1300
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1192
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2256
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:952
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:700
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1748
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1108
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:432
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2668
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1100
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:3004
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2116
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:636
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2204
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2064
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1688
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:976
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2248
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:3024
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1544
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2528
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2740
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1560
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2852
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1280
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1592
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2192
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1992
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2436
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2416
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2540
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2772
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2464
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1808
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2148
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2932
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1428
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1976
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2904
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1048
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2628
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1768
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1032
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2600
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:628
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2312
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1316
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:700
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2964
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2084
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2384
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1528
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:3012
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2032
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2064
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:528
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:976
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:904
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1348
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1500
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1952
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2240
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2740
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2564
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2524
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:240
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2472
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2100
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2452
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2920
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1616
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1624
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2872
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2312
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1928
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1760
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1052
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:188
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1476
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1232
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:560
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1500
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:608
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2740
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2188
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1592
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1076
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2476
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2100
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:920
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2924
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2432
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2932
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1640
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2012
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2136
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:3060
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:860
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1316
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:700
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2644
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:432
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1728
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2072
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:772
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:3048
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1232
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2064
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2596
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1500
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2104
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:608
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:844
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2036
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1672
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:820
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1076
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2472
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2228
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2100
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2804
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2376
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1564
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1428
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:808
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2960
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2272
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1932
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1496
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1756
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1056
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1100
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:800
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2876
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:932
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2784
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2772
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2604
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:968
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1796
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2116
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2384
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1752
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1044
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1616
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1740
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2872
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2028
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1704
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:952
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1100
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2068
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1764
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2944
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1968
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:320
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1964
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2748
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:436
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2428
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2996
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2688
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:3028
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:764
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2936
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1456
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:572
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1312
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2264
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2620
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1680
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2256
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1932
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1508
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1928
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2816
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1496
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1844
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2792
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2752
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:1748
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2444
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2388
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:3040
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:432
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1652
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2044
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:3000
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2864
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1016
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2828
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2684
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2464
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2668
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        
        PID:2848
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\ProgramData\rrrrrrrr.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2468
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Java Install.jar"
  2⤵
  PID:2456
- C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe
  "C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2420

C:\Windows\system32\taskeng.exe
taskeng.exe {C359ABF2-8A2F-40CC-BFE5-7DB4DFE2A544} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:2776
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2972
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2484
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1016
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe" -f TorConfig
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1040
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2100
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2260
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1824
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2868
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1584
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:760
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2892
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1688
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2572
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2944
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2708
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2400
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2936
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:988
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:3012
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:436
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2612
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2696
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:3064
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:1320
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2564
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2936
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2748
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:1996
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2176
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2112
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2208
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2072
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2148
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2460
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2704
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2884
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1488
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2420
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2144
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:1060
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1584
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:1032
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:1976
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:1668
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2212
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:2420
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2344
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:2704
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2112
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:1556
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2980
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion