ardamax | 6887a011a50a7d456068aecba506feb3db57be4710d190141a60afa00d5aa97a

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	softSteam.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	softSteam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	softSteam.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\International\Geo\Nation	Windows Services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Startup.lnk	Launcher.exe

Executes dropped EXE 10 IoCs

pid	Process
4440	Windows Services.exe
1124	Secure System Shell.exe
1308	Runtime Explorer.exe
2380	._cache_Jint.exe
1040	Synaptics.exe
1668	Runtime Broker.exe
4632	._cache_Synaptics.exe
3816	UMT.exe
3264	UMT.exe
3496	UMT.exe

Loads dropped DLL 64 IoCs

pid	Process
4364	AlphaFS.lib
4364	AlphaFS.lib
4364	AlphaFS.lib
4364	AlphaFS.lib
4364	AlphaFS.lib
4364	AlphaFS.lib
4364	AlphaFS.lib
4364	AlphaFS.lib
4364	AlphaFS.lib
4364	AlphaFS.lib
4364	AlphaFS.lib
4364	AlphaFS.lib
4364	AlphaFS.lib
4364	AlphaFS.lib
4364	AlphaFS.lib
4364	AlphaFS.lib
4364	AlphaFS.lib
4364	AlphaFS.lib
4364	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
2068	AlphaFS.lib
1416	softSteam.exe
2956	SaveSoft.exe
3816	UMT.exe
3816	UMT.exe
1668	Runtime Broker.exe
1668	Runtime Broker.exe
1040	Synaptics.exe
1040	Synaptics.exe
1124	Secure System Shell.exe
1308	Runtime Explorer.exe
1308	Runtime Explorer.exe
4440	Windows Services.exe
4440	Windows Services.exe
3944	Minecraft Generator By Zed.exe
3944	Minecraft Generator By Zed.exe
5040	Launcher.exe
5040	Launcher.exe
1392	lib.exe
1392	lib.exe
3264	UMT.exe
3264	UMT.exe
416	Minecraft Generator By Zed.exe
416	Minecraft Generator By Zed.exe
2996	Launcher.exe
2996	Launcher.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Generators PACK\\Generators PACK\\Amazong GC Generator by Acquire\\ieproxy.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral13/files/0x0008000000023685-692.dat	themida
behavioral13/memory/1416-695-0x000000006E400000-0x000000006E9C2000-memory.dmp	themida
behavioral13/memory/1416-697-0x000000006E400000-0x000000006E9C2000-memory.dmp	themida
behavioral13/memory/1416-704-0x000000006E400000-0x000000006E9C2000-memory.dmp	themida
behavioral13/memory/1416-709-0x000000006E400000-0x000000006E9C2000-memory.dmp	themida
behavioral13/memory/1416-730-0x000000006E400000-0x000000006E9C2000-memory.dmp	themida

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Explorer = "C:\\Windows\\IMF\\\\Windows Services.exe"	Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	Jint.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UMT Start = "C:\\ProgramData\\NSGMFX\\UMT.exe"	UMT.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1416	softSteam.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\IMF\Runtime Explorer.exe.tmp	Launcher.exe
File opened for modification	C:\Windows\IMF\Windows Services.exe	Launcher.exe
File created	C:\Windows\IMF\LICENCE.zip	Launcher.exe
File opened for modification	C:\Windows\IMF\LICENCE.zip	Launcher.exe
File created	C:\Windows\IMF\LICENCE.dat	Launcher.exe
File created	C:\Windows\IMF\Windows Services.exe.tmp	Launcher.exe
File opened for modification	C:\Windows\IMF\Runtime Explorer.exe	Launcher.exe
File created	C:\Windows\IMF\Secure System Shell.exe.tmp	Launcher.exe
File opened for modification	C:\Windows\IMF\Secure System Shell.exe	Launcher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\Accessibility\Blind Access\On = "1"	UMT.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91A565C1-E38F-11D0-94BF-00A0C9055CBF}\ = "IPersistHistory"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{131A6950-7F78-11D0-A979-00C04FD705A2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1144dd5c-5a0d-494c-b316-81683a74ea8a}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B0D63B78-78AD-5E31-B6D8-E32A0E16C447}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B0D63B78-78AD-5E31-B6D8-E32A0E16C447}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14B6DF29-7914-47AE-BB24-DD8E8A332F33}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{520c4037-5f9b-4409-b60c-81a357993675}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D1203147-AC90-44B4-AD8E-B0D91A4F494F}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2649E5E-E1A3-4255-B764-D7531A794042}\ = "ILCIEComponent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B6FD0B71-E2BC-4653-8D05-F197E412770B}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC16B858-0D6E-47D2-BFB3-04683ED1E87D}\NumMethods\ = "4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC4801A1-2BA9-11CF-A229-00AA003D7352}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AC79548C-D94C-44A1-9032-F8BB96ABB82B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F6A76981-4245-4415-8A38-D2790017AD73}\NumMethods\ = "5"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2D6065A-23CD-45D9-8A32-39FD7EC931D5}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B45394F-79B0-44E0-93C4-82B06AD9D4C1}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D5F78C80-5252-11CF-90FA-00AA0042106E}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D318FB7E-FF28-497E-A566-9DF09E6C503B}\ProxyStubClsid32\ = "{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0BE5B80-933F-4E32-900A-A28E31BDB9CF}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E47B8999-CCE4-4255-93A8-5899A8D30ACE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAB63DD1-32FB-449E-8434-EDC42C0830ED}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C1-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "11"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{196BAB51-2C67-485A-A74F-557182263013}\ = "IEDataObjectInternal"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CB8E9BAF-8F6A-4931-85C0-BB6DB9B9C4D1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3AC0D21-0ABA-41A3-BFF8-79603B9880BA}\ProxyStubClsid32\ = "{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23C71F7D-4DD8-4FFB-942B-A9F13DC9C509}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91A565C1-E38F-11D0-94BF-00A0C9055CBF}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ABC8C20F-B26B-47D1-B9C1-62194685FCB1}\NumMethods\ = "5"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5ABDC2AD-7329-4C95-8D32-BB84799FCF88}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{32966928-6FC2-45EC-A8AC-1BC6FD428C83}\ProxyStubClsid32\ = "{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B2103BDB-B79E-4474-8424-4363161118D5}\NumMethods\ = "4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{660B3255-6433-49ED-A12B-A6A446E26431}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	lib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF11D3DB-81A6-4B88-AE07-96ECCF46D076}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA0BABDC-1184-4108-AED3-20CB6DF92864}\ = "IDualEngine4Browser"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{631f9262-b99a-4a5c-931a-eb9bd5233f4c}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BC876E52-7DC2-440E-87A8-3C1221F10C92}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CCFB755F-13B4-4D15-84C7-92D241425A5C}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC8AFC62-F788-4B36-8889-FD073FDD2FD9}\ProxyStubClsid32	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	lib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8110D918-82D3-4106-A563-AA29A082BF42}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B722BCC6-4E68-101B-A2BC-00AA00404770}\ProxyStubClsid32\ = "{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BC47C6E9-7DD7-4C49-ACA6-dACA4710E807}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D6-BAFA-11CE-8C82-00AA004BA90B}\NumMethods\ = "4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A11E36F5-D54C-4CAD-BEF1-C2DDAE7BE6A3}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F568E3E-317C-402E-A883-546B0F7673A4}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F2D35B3-DB34-4966-BEA6-59C7CD203862}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}\ = "IInternetSecurityManager"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{abebf21e-e734-44d0-b7e1-1c3a8420f7b9}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AC7516E-E6BB-4A69-B63F-E841904DC5A6}\ = "IEUserBroker"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{687A3C9E-950A-490F-B706-872B5A95D701}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C9-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "11"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B92DAAC-C102-44C4-9DBF-78F959C69E10}\ProxyStubClsid32\ = "{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3051046B-98B5-11CF-BB82-00AA00BDCE0B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B722BCC5-4E68-101B-A2BC-00AA00404770}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2DA1EFD-1DFA-43E1-911F-E18288E361B0}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7847EC01-2BEC-11D0-82B4-00A0C90C29C5}\NumMethods\ = "5"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5357E238-FB12-4ACA-A930-CAB7832B84BF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B5D1318C-89BA-4166-AF8B-76B0DF8E7D46}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7819A000-56F5-432F-BF43-662A11261696}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7819A000-56F5-432F-BF43-662A11261696}\ = "IEInetcplRasBroker"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7F3C143A-6083-48F4-A997-56040A4C1D51}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA176B85-0E12-4844-8E1A-EEF1DA77F586}	regsvr32.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1668	Runtime Broker.exe
652	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3788	Launcher.exe
3788	Launcher.exe
4036	powershell.exe
4036	powershell.exe
4036	powershell.exe
4440	Windows Services.exe
4440	Windows Services.exe
4440	Windows Services.exe
4440	Windows Services.exe
4440	Windows Services.exe
1124	Secure System Shell.exe
1124	Secure System Shell.exe
5012	Launcher.exe
5012	Launcher.exe
1932	Launcher.exe
1932	Launcher.exe
1652	Launcher.exe
2936	msedge.exe
2936	msedge.exe
2456	msedge.exe
2456	msedge.exe
2400	Launcher.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
2956	SaveSoft.exe
4040	Launcher.exe
2800	Launcher.exe
3816	UMT.exe
3816	UMT.exe
5040	Launcher.exe
2996	Launcher.exe
4084	Launcher.exe
4084	Launcher.exe
1244	msedge.exe
1244	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2956	SaveSoft.exe
3816	UMT.exe
2964	lib.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3788	Launcher.exe
Token: SeDebugPrivilege	4036	powershell.exe
Token: SeDebugPrivilege	4440	Windows Services.exe
Token: SeDebugPrivilege	1124	Secure System Shell.exe
Token: SeDebugPrivilege	5012	Launcher.exe
Token: 35	4364	AlphaFS.lib
Token: 35	2068	AlphaFS.lib
Token: SeDebugPrivilege	1932	Launcher.exe
Token: SeDebugPrivilege	1652	Launcher.exe
Token: SeDebugPrivilege	2400	Launcher.exe
Token: SeDebugPrivilege	4040	Launcher.exe
Token: SeDebugPrivilege	4272	sysBeta.exe
Token: SeDebugPrivilege	2800	Launcher.exe
Token: SeDebugPrivilege	5040	Launcher.exe
Token: SeDebugPrivilege	2996	Launcher.exe
Token: SeDebugPrivilege	4084	Launcher.exe
Token: SeDebugPrivilege	3468	Launcher.exe
Token: SeDebugPrivilege	1984	Launcher.exe
Token: SeDebugPrivilege	2868	Launcher.exe
Token: SeDebugPrivilege	576	Launcher.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1308	Runtime Explorer.exe
652	EXCEL.EXE
652	EXCEL.EXE
652	EXCEL.EXE
652	EXCEL.EXE
2956	SaveSoft.exe
3816	UMT.exe
3816	UMT.exe
3816	UMT.exe
3816	UMT.exe
4300	Gen.exe
2964	lib.exe
2964	lib.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 3788	3124	AGC by Acquire.exe	95
PID 3124 wrote to memory of 3788	3124	AGC by Acquire.exe	95
PID 3124 wrote to memory of 3788	3124	AGC by Acquire.exe	95
PID 3788 wrote to memory of 4036	3788	Launcher.exe	97
PID 3788 wrote to memory of 4036	3788	Launcher.exe	97
PID 3788 wrote to memory of 4036	3788	Launcher.exe	97
PID 3124 wrote to memory of 2576	3124	AGC by Acquire.exe	96
PID 3124 wrote to memory of 2576	3124	AGC by Acquire.exe	96
PID 3788 wrote to memory of 4440	3788	Launcher.exe	100
PID 3788 wrote to memory of 4440	3788	Launcher.exe	100
PID 3788 wrote to memory of 4440	3788	Launcher.exe	100
PID 4440 wrote to memory of 1124	4440	Windows Services.exe	101
PID 4440 wrote to memory of 1124	4440	Windows Services.exe	101
PID 4440 wrote to memory of 1124	4440	Windows Services.exe	101
PID 4440 wrote to memory of 1308	4440	Windows Services.exe	102
PID 4440 wrote to memory of 1308	4440	Windows Services.exe	102
PID 4440 wrote to memory of 1308	4440	Windows Services.exe	102
PID 3568 wrote to memory of 5012	3568	DiscordGenerator.exe	106
PID 3568 wrote to memory of 5012	3568	DiscordGenerator.exe	106
PID 3568 wrote to memory of 5012	3568	DiscordGenerator.exe	106
PID 3568 wrote to memory of 2560	3568	DiscordGenerator.exe	107
PID 3568 wrote to memory of 2560	3568	DiscordGenerator.exe	107
PID 3568 wrote to memory of 2560	3568	DiscordGenerator.exe	107
PID 2560 wrote to memory of 2380	2560	Jint.exe	108
PID 2560 wrote to memory of 2380	2560	Jint.exe	108
PID 2560 wrote to memory of 2380	2560	Jint.exe	108
PID 2560 wrote to memory of 1040	2560	Jint.exe	110
PID 2560 wrote to memory of 1040	2560	Jint.exe	110
PID 2560 wrote to memory of 1040	2560	Jint.exe	110
PID 2380 wrote to memory of 1668	2380	._cache_Jint.exe	111
PID 2380 wrote to memory of 1668	2380	._cache_Jint.exe	111
PID 2380 wrote to memory of 1668	2380	._cache_Jint.exe	111
PID 2380 wrote to memory of 4768	2380	._cache_Jint.exe	112
PID 2380 wrote to memory of 4768	2380	._cache_Jint.exe	112
PID 4768 wrote to memory of 4364	4768	AlphaFS.lib	113
PID 4768 wrote to memory of 4364	4768	AlphaFS.lib	113
PID 1040 wrote to memory of 4632	1040	Synaptics.exe	114
PID 1040 wrote to memory of 4632	1040	Synaptics.exe	114
PID 1040 wrote to memory of 4632	1040	Synaptics.exe	114
PID 4632 wrote to memory of 4976	4632	._cache_Synaptics.exe	117
PID 4632 wrote to memory of 4976	4632	._cache_Synaptics.exe	117
PID 4364 wrote to memory of 4316	4364	AlphaFS.lib	118
PID 4364 wrote to memory of 4316	4364	AlphaFS.lib	118
PID 4364 wrote to memory of 1484	4364	AlphaFS.lib	119
PID 4364 wrote to memory of 1484	4364	AlphaFS.lib	119
PID 4976 wrote to memory of 2068	4976	AlphaFS.lib	120
PID 4976 wrote to memory of 2068	4976	AlphaFS.lib	120
PID 2068 wrote to memory of 4940	2068	AlphaFS.lib	121
PID 2068 wrote to memory of 4940	2068	AlphaFS.lib	121
PID 2068 wrote to memory of 3772	2068	AlphaFS.lib	122
PID 2068 wrote to memory of 3772	2068	AlphaFS.lib	122
PID 2068 wrote to memory of 4344	2068	AlphaFS.lib	126
PID 2068 wrote to memory of 4344	2068	AlphaFS.lib	126
PID 2068 wrote to memory of 3928	2068	AlphaFS.lib	127
PID 2068 wrote to memory of 3928	2068	AlphaFS.lib	127
PID 2068 wrote to memory of 4116	2068	AlphaFS.lib	128
PID 2068 wrote to memory of 4116	2068	AlphaFS.lib	128
PID 4364 wrote to memory of 2944	4364	AlphaFS.lib	129
PID 4364 wrote to memory of 2944	4364	AlphaFS.lib	129
PID 4364 wrote to memory of 4656	4364	AlphaFS.lib	130
PID 4364 wrote to memory of 4656	4364	AlphaFS.lib	130
PID 4364 wrote to memory of 212	4364	AlphaFS.lib	131
PID 4364 wrote to memory of 212	4364	AlphaFS.lib	131
PID 116 wrote to memory of 1932	116	SteamAccCreator.exe	133

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Amazong GC Generator by Acquire\ieproxy.dll"
1⤵
- Registers COM server for autorun
- Modifies registry class
PID:2152

C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Amazong GC Generator by Acquire\AGC by Acquire.exe
"C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Amazong GC Generator by Acquire\AGC by Acquire.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Amazong GC Generator by Acquire\WebDriver\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Amazong GC Generator by Acquire\WebDriver\Launcher.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4036
- - C:\Windows\IMF\Windows Services.exe
    "C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Windows\IMF\Secure System Shell.exe
      "C:\Windows\IMF\Secure System Shell.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1124
  - - C:\Windows\IMF\Runtime Explorer.exe
      "C:\Windows\IMF\Runtime Explorer.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1308
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Amazong GC Generator by Acquire\WebDriver\user32.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Amazong GC Generator by Acquire\WebDriver\user32.exe"
  2⤵
  PID:2576

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Amazong GC Generator by Acquire\giftcards.txt
1⤵
PID:8

C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Discord Account Generator v2\DiscordGenerator.exe
"C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Discord Account Generator v2\DiscordGenerator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Discord Account Generator v2\RDXService\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Discord Account Generator v2\RDXService\Launcher.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Discord Account Generator v2\RDXService\Jint.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Discord Account Generator v2\RDXService\Jint.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Discord Account Generator v2\._cache_Jint.exe
    "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Discord Account Generator v2\._cache_Jint.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\ProgramData\Windows Portable Clipboard\Runtime Broker.exe
      "C:\\ProgramData\\Windows Portable Clipboard\\Runtime Broker.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: AddClipboardFormatListener
      PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Discord Account Generator v2\AlphaFS.lib
      "AlphaFS.lib"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Discord Account Generator v2\AlphaFS.lib
        
        "AlphaFS.lib"
        5⤵
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4364
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:4316
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c title Discord Generator ^| coded by Nightfall#2512
        6⤵
        
        PID:1484
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:2944
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:4656
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c title Discord Generator ^| Proxy: False ^| Threading: False
        6⤵
        
        PID:212
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Discord Account Generator v2\._cache_Synaptics.exe
      "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Discord Account Generator v2\._cache_Synaptics.exe" InjUpdate
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Discord Account Generator v2\AlphaFS.lib
        
        "AlphaFS.lib"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Discord Account Generator v2\AlphaFS.lib
        
        "AlphaFS.lib"
        6⤵
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        7⤵
        
        PID:4940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c title Discord Generator ^| coded by Nightfall#2512
        7⤵
        
        PID:3772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        7⤵
        
        PID:4344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        7⤵
        
        PID:3928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c title Discord Generator ^| Proxy: False ^| Threading: False
        7⤵
        
        PID:4116

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:652

C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Steam Account Generator\SteamAccCreator.exe
"C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Steam Account Generator\SteamAccCreator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:116
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Steam Account Generator\data\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Steam Account Generator\data\Launcher.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1932
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Steam Account Generator\data\softSteam.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Steam Account Generator\data\softSteam.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1416

C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Gift Card Generator By MT_SOFT\Gift Card Generator By MT_SOFT.exe
"C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Gift Card Generator By MT_SOFT\Gift Card Generator By MT_SOFT.exe"
1⤵
PID:2504
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Gift Card Generator By MT_SOFT\lib\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Gift Card Generator By MT_SOFT\lib\Launcher.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Gift Card Generator By MT_SOFT\lib\GC by SOFT.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Gift Card Generator By MT_SOFT\lib\GC by SOFT.exe"
  2⤵
  PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/AccountCrack
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fff931b46f8,0x7fff931b4708,0x7fff931b4718
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9339526150941819555,10389182171911069487,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
      4⤵
      PID:3636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,9339526150941819555,10389182171911069487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,9339526150941819555,10389182171911069487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9339526150941819555,10389182171911069487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
      4⤵
      PID:696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9339526150941819555,10389182171911069487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
      4⤵
      PID:956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9339526150941819555,10389182171911069487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
      4⤵
      PID:3388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Gift Card Generator By MT_SOFT\Results\hits.txt
1⤵
PID:452

C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\combolist generator BY X-KILLER\combolist generator BY X-KILLER.exe
"C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\combolist generator BY X-KILLER\combolist generator BY X-KILLER.exe"
1⤵
PID:764
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\combolist generator BY X-KILLER\GatherCfg\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\combolist generator BY X-KILLER\GatherCfg\Launcher.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\combolist generator BY X-KILLER\GatherCfg\SaveSoft.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\combolist generator BY X-KILLER\GatherCfg\SaveSoft.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2956

C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Proxy Generator 1.3.6 BETA\Proxy Generator 1.3.6 BETA.exe
"C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Proxy Generator 1.3.6 BETA\Proxy Generator 1.3.6 BETA.exe"
1⤵
PID:3720
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Proxy Generator 1.3.6 BETA\bin\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Proxy Generator 1.3.6 BETA\bin\Launcher.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4040
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Proxy Generator 1.3.6 BETA\bin\sysBeta.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Proxy Generator 1.3.6 BETA\bin\sysBeta.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4272

C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Minecraft Generator By Zed\Minecraft Generator By Zed.exe
"C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Minecraft Generator By Zed\Minecraft Generator By Zed.exe"
1⤵
PID:2508
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Minecraft Generator By Zed\xml\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Minecraft Generator By Zed\xml\Launcher.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2800
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Minecraft Generator By Zed\xml\lib.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Minecraft Generator By Zed\xml\lib.exe"
  2⤵
  PID:3472
- - C:\ProgramData\NSGMFX\UMT.exe
    "C:\ProgramData\NSGMFX\UMT.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies Control Panel
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3816

C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Minecraft Generator By Zed\Minecraft Generator By Zed.exe
"C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Minecraft Generator By Zed\Minecraft Generator By Zed.exe"
1⤵
- Loads dropped DLL
PID:3944
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Minecraft Generator By Zed\xml\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Minecraft Generator By Zed\xml\Launcher.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5040
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Minecraft Generator By Zed\xml\lib.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Minecraft Generator By Zed\xml\lib.exe"
  2⤵
  - Loads dropped DLL
  PID:1392
- - C:\ProgramData\NSGMFX\UMT.exe
    "C:\ProgramData\NSGMFX\UMT.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3264

C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Minecraft Generator By Zed\Minecraft Generator By Zed.exe
"C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Minecraft Generator By Zed\Minecraft Generator By Zed.exe"
1⤵
- Loads dropped DLL
PID:416
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Minecraft Generator By Zed\xml\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Minecraft Generator By Zed\xml\Launcher.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2996
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Minecraft Generator By Zed\xml\lib.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Minecraft Generator By Zed\xml\lib.exe"
  2⤵
  PID:384
- - C:\ProgramData\NSGMFX\UMT.exe
    "C:\ProgramData\NSGMFX\UMT.exe"
    3⤵
    - Executes dropped EXE
    PID:3496

C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Netflix GC Generator By SpaceXVIII\Netflix GC Cracked.to.exe
"C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Netflix GC Generator By SpaceXVIII\Netflix GC Cracked.to.exe"
1⤵
PID:1664
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Netflix GC Generator By SpaceXVIII\Gen\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Netflix GC Generator By SpaceXVIII\Gen\Launcher.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4084
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Netflix GC Generator By SpaceXVIII\Gen\GC.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Netflix GC Generator By SpaceXVIII\Gen\GC.exe"
  2⤵
  PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cracked.to/SpaceXVIII
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff931b46f8,0x7fff931b4708,0x7fff931b4718
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,1133556117658297743,4862417867641884754,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
      4⤵
      PID:2676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,1133556117658297743,4862417867641884754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,1133556117658297743,4862417867641884754,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
      4⤵
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,1133556117658297743,4862417867641884754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,1133556117658297743,4862417867641884754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,1133556117658297743,4862417867641884754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
      4⤵
      PID:3128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Netflix GC Generator By SpaceXVIII\Gen\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Netflix GC Generator By SpaceXVIII\Gen\Launcher.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3468

C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Netflix GC Generator By SpaceXVIII\Gen\GC.exe
"C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Netflix GC Generator By SpaceXVIII\Gen\GC.exe"
1⤵
PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cracked.to/SpaceXVIII
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff931b46f8,0x7fff931b4708,0x7fff931b4718
    3⤵
    PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,5038718478255613789,12520859318403775057,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,5038718478255613789,12520859318403775057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,5038718478255613789,12520859318403775057,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5038718478255613789,12520859318403775057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5038718478255613789,12520859318403775057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5038718478255613789,12520859318403775057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
    3⤵
    PID:1532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1984

C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Dork Generator by broklyn\SQLi Dorks Generator.exe
"C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Dork Generator by broklyn\SQLi Dorks Generator.exe"
1⤵
PID:3188
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Dork Generator by broklyn\AntiPublic\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Dork Generator by broklyn\AntiPublic\Launcher.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1984
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Dork Generator by broklyn\AntiPublic\Gen.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Dork Generator by broklyn\AntiPublic\Gen.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4300

C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Stolen Nitro Discord Code Generator\_Stolen Nitro Code Generator.exe
"C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Stolen Nitro Discord Code Generator\_Stolen Nitro Code Generator.exe"
1⤵
PID:3488
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Stolen Nitro Discord Code Generator\library\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Stolen Nitro Discord Code Generator\library\Launcher.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2868

C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\In Shadow Batch Virus Gen - 5.0.0 - MOD\In Shadow Batch Virus Gen - 5.0.0 - MOD.exe
"C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\In Shadow Batch Virus Gen - 5.0.0 - MOD\In Shadow Batch Virus Gen - 5.0.0 - MOD.exe"
1⤵
PID:3328
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\In Shadow Batch Virus Gen - 5.0.0 - MOD\data\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\In Shadow Batch Virus Gen - 5.0.0 - MOD\data\Launcher.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:576
- C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\In Shadow Batch Virus Gen - 5.0.0 - MOD\data\lib.exe
  "C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\In Shadow Batch Virus Gen - 5.0.0 - MOD\data\lib.exe"
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\bob.bat" "
1⤵
PID:2504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\bob.bat" "
1⤵
PID:1312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\bob.bat" "
1⤵
PID:1332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\bob.bat" "
1⤵
PID:2976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\bob.bat" "
1⤵
PID:1408

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\bob.bat"
1⤵
PID:1452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff931b46f8,0x7fff931b4708,0x7fff931b4718
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,7297091164674204569,9703764225796218116,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,7297091164674204569,9703764225796218116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,7297091164674204569,9703764225796218116,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7297091164674204569,9703764225796218116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7297091164674204569,9703764225796218116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7297091164674204569,9703764225796218116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2812 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7297091164674204569,9703764225796218116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7297091164674204569,9703764225796218116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,7297091164674204569,9703764225796218116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,7297091164674204569,9703764225796218116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7297091164674204569,9703764225796218116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7297091164674204569,9703764225796218116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7297091164674204569,9703764225796218116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7297091164674204569,9703764225796218116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7297091164674204569,9703764225796218116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,7297091164674204569,9703764225796218116,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3060 /prefetch:2
  2⤵
  PID:756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

System Information Discovery