amadey | 31b22e4749a83b1397e32c38bac0d7b98032d40d4542cde35392e7b365c82246

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	31b22e4749a83b1397e32c38bac0d7b98032d40d4542cde35392e7b365c82246.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2192	powershell.exe
1248	powershell.exe

Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	31b22e4749a83b1397e32c38bac0d7b98032d40d4542cde35392e7b365c82246.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	31b22e4749a83b1397e32c38bac0d7b98032d40d4542cde35392e7b365c82246.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe

Executes dropped EXE 2 IoCs

pid	Process
1252	explorta.exe
3104	explorta.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine	explorta.exe

Themida packer 35 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/1472-3-0x0000000000900000-0x0000000000E5E000-memory.dmp	themida
behavioral2/memory/1472-8-0x0000000000900000-0x0000000000E5E000-memory.dmp	themida
behavioral2/memory/1472-6-0x0000000000900000-0x0000000000E5E000-memory.dmp	themida
behavioral2/memory/1472-5-0x0000000000900000-0x0000000000E5E000-memory.dmp	themida
behavioral2/memory/1472-4-0x0000000000900000-0x0000000000E5E000-memory.dmp	themida
behavioral2/memory/1472-1-0x0000000000900000-0x0000000000E5E000-memory.dmp	themida
behavioral2/memory/1472-7-0x0000000000900000-0x0000000000E5E000-memory.dmp	themida
behavioral2/memory/1472-2-0x0000000000900000-0x0000000000E5E000-memory.dmp	themida
behavioral2/memory/1472-0-0x0000000000900000-0x0000000000E5E000-memory.dmp	themida
behavioral2/files/0x000100000002aa12-14.dat	themida
behavioral2/memory/1252-29-0x0000000000F40000-0x000000000149E000-memory.dmp	themida
behavioral2/memory/1252-30-0x0000000000F40000-0x000000000149E000-memory.dmp	themida
behavioral2/memory/1252-28-0x0000000000F40000-0x000000000149E000-memory.dmp	themida
behavioral2/memory/1252-27-0x0000000000F40000-0x000000000149E000-memory.dmp	themida
behavioral2/memory/1252-25-0x0000000000F40000-0x000000000149E000-memory.dmp	themida
behavioral2/memory/1252-23-0x0000000000F40000-0x000000000149E000-memory.dmp	themida
behavioral2/memory/1252-22-0x0000000000F40000-0x000000000149E000-memory.dmp	themida
behavioral2/memory/1252-26-0x0000000000F40000-0x000000000149E000-memory.dmp	themida
behavioral2/memory/1252-24-0x0000000000F40000-0x000000000149E000-memory.dmp	themida
behavioral2/memory/1472-21-0x0000000000900000-0x0000000000E5E000-memory.dmp	themida
behavioral2/memory/3104-37-0x0000000000F40000-0x000000000149E000-memory.dmp	themida
behavioral2/memory/1252-63-0x0000000000F40000-0x000000000149E000-memory.dmp	themida
behavioral2/files/0x000100000002aa17-103.dat	themida
behavioral2/memory/4080-117-0x00000000006D0000-0x0000000000D57000-memory.dmp	themida
behavioral2/memory/4080-118-0x00000000006D0000-0x0000000000D57000-memory.dmp	themida
behavioral2/memory/4080-120-0x00000000006D0000-0x0000000000D57000-memory.dmp	themida
behavioral2/memory/4080-119-0x00000000006D0000-0x0000000000D57000-memory.dmp	themida
behavioral2/memory/4080-121-0x00000000006D0000-0x0000000000D57000-memory.dmp	themida
behavioral2/memory/4080-122-0x00000000006D0000-0x0000000000D57000-memory.dmp	themida
behavioral2/memory/4080-125-0x00000000006D0000-0x0000000000D57000-memory.dmp	themida
behavioral2/memory/4080-123-0x00000000006D0000-0x0000000000D57000-memory.dmp	themida
behavioral2/memory/4080-124-0x00000000006D0000-0x0000000000D57000-memory.dmp	themida
behavioral2/memory/1252-186-0x0000000000F40000-0x000000000149E000-memory.dmp	themida
behavioral2/files/0x000100000002aa61-485.dat	themida
behavioral2/memory/3444-488-0x0000000140000000-0x0000000140917000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	31b22e4749a83b1397e32c38bac0d7b98032d40d4542cde35392e7b365c82246.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorta.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
43	pastebin.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa1e-154.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3104	explorta.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1252 set thread context of 3104	1252	explorta.exe	78

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorta.job	31b22e4749a83b1397e32c38bac0d7b98032d40d4542cde35392e7b365c82246.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
248	sc.exe
4488	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
248	664	WerFault.exe	82
2248	3424	WerFault.exe	124

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
448	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3104	explorta.exe
3104	explorta.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 1252	1472	31b22e4749a83b1397e32c38bac0d7b98032d40d4542cde35392e7b365c82246.exe	77
PID 1472 wrote to memory of 1252	1472	31b22e4749a83b1397e32c38bac0d7b98032d40d4542cde35392e7b365c82246.exe	77
PID 1472 wrote to memory of 1252	1472	31b22e4749a83b1397e32c38bac0d7b98032d40d4542cde35392e7b365c82246.exe	77
PID 1252 wrote to memory of 3104	1252	explorta.exe	78
PID 1252 wrote to memory of 3104	1252	explorta.exe	78
PID 1252 wrote to memory of 3104	1252	explorta.exe	78
PID 1252 wrote to memory of 3104	1252	explorta.exe	78
PID 1252 wrote to memory of 3104	1252	explorta.exe	78
PID 1252 wrote to memory of 3104	1252	explorta.exe	78
PID 1252 wrote to memory of 3104	1252	explorta.exe	78
PID 1252 wrote to memory of 3104	1252	explorta.exe	78
PID 1252 wrote to memory of 3104	1252	explorta.exe	78
PID 1252 wrote to memory of 3104	1252	explorta.exe	78
PID 1252 wrote to memory of 3104	1252	explorta.exe	78
PID 1252 wrote to memory of 3104	1252	explorta.exe	78

C:\Users\Admin\AppData\Local\Temp\31b22e4749a83b1397e32c38bac0d7b98032d40d4542cde35392e7b365c82246.exe
"C:\Users\Admin\AppData\Local\Temp\31b22e4749a83b1397e32c38bac0d7b98032d40d4542cde35392e7b365c82246.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
  "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
    "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:3104
- - C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe
    "C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe"
    3⤵
    PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      4⤵
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe"
        5⤵
        
        PID:664
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:2124
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 888
        6⤵
        Program crash
        
        PID:248
    - - C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe"
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\1000073001\swiy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000073001\swiy.exe"
        5⤵
        
        PID:588
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe"
        5⤵
        
        PID:3020
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe" -Force
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2192
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
        6⤵
        
        PID:3380
        
        C:\Users\Admin\Pictures\Ert8hM4u2KkmgDuuiKaVP7iV.exe
        
        "C:\Users\Admin\Pictures\Ert8hM4u2KkmgDuuiKaVP7iV.exe"
        7⤵
        
        PID:880
        
        C:\Users\Admin\Pictures\rHT3RkSXBywdAEVtC1ok3wvS.exe
        
        "C:\Users\Admin\Pictures\rHT3RkSXBywdAEVtC1ok3wvS.exe"
        7⤵
        
        PID:4640
        
        C:\Users\Admin\Pictures\BGfVIDVmaJM2CgJoMhLSfG8P.exe
        
        "C:\Users\Admin\Pictures\BGfVIDVmaJM2CgJoMhLSfG8P.exe"
        7⤵
        
        PID:2396
        
        C:\Users\Admin\Pictures\w3n7xjldcIZhWMz8qSDcrJ34.exe
        
        "C:\Users\Admin\Pictures\w3n7xjldcIZhWMz8qSDcrJ34.exe"
        7⤵
        
        PID:1176
        
        C:\Users\Admin\Pictures\MfxZAmk3Fx6gtLVhCpruWTe4.exe
        
        "C:\Users\Admin\Pictures\MfxZAmk3Fx6gtLVhCpruWTe4.exe"
        7⤵
        
        PID:3952
        
        C:\Users\Admin\Pictures\CTltmOHiFlSDVhYkh6XwX2Gr.exe
        
        "C:\Users\Admin\Pictures\CTltmOHiFlSDVhYkh6XwX2Gr.exe"
        7⤵
        
        PID:3444
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
        6⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe"
        5⤵
        
        PID:4876
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:1532
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe"
        5⤵
        
        PID:3424
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
        7⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
        7⤵
        
        PID:2864
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 364
        6⤵
        Program crash
        
        PID:2248
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
        5⤵
        
        PID:1600
      - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
        6⤵
        
        PID:4816
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        7⤵
        
        PID:3468
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\230210488309_Desktop.zip' -CompressionLevel Optimal
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\1000081001\install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000081001\install.exe"
        5⤵
        
        PID:3828
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
        6⤵
        
        PID:748
        
        C:\Windows\SysWOW64\sc.exe
        
        Sc stop GameServerClient
        7⤵
        Launches sc.exe
        
        PID:4488
        
        C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService remove GameServerClient confirm
        7⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\sc.exe
        
        Sc delete GameSyncLink
        7⤵
        Launches sc.exe
        
        PID:248
        
        C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService remove GameSyncLink confirm
        7⤵
        
        PID:4196
        
        C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
        7⤵
        
        PID:4800
        
        C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService start GameSyncLink
        7⤵
        
        PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe"
        5⤵
        
        PID:1488
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\1000244001\ISetup8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000244001\ISetup8.exe"
        6⤵
        
        PID:3836
- - C:\Users\Admin\AppData\Local\Temp\1000020001\7086ebf7c5.exe
    "C:\Users\Admin\AppData\Local\Temp\1000020001\7086ebf7c5.exe"
    3⤵
    PID:4080
- - C:\Users\Admin\1000021002\5195173a17.exe
    "C:\Users\Admin\1000021002\5195173a17.exe"
    3⤵
    PID:2820
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      PID:2496
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffad495ab58,0x7ffad495ab68,0x7ffad495ab78
        5⤵
        
        PID:2628
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1828,i,4382803057602350276,8093224821226421910,131072 /prefetch:2
        5⤵
        
        PID:1204
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1828,i,4382803057602350276,8093224821226421910,131072 /prefetch:8
        5⤵
        
        PID:4240
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2168 --field-trial-handle=1828,i,4382803057602350276,8093224821226421910,131072 /prefetch:8
        5⤵
        
        PID:2972
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1828,i,4382803057602350276,8093224821226421910,131072 /prefetch:1
        5⤵
        
        PID:1444
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1828,i,4382803057602350276,8093224821226421910,131072 /prefetch:1
        5⤵
        
        PID:356
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4192 --field-trial-handle=1828,i,4382803057602350276,8093224821226421910,131072 /prefetch:1
        5⤵
        
        PID:4912
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3416 --field-trial-handle=1828,i,4382803057602350276,8093224821226421910,131072 /prefetch:8
        5⤵
        
        PID:2008
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 --field-trial-handle=1828,i,4382803057602350276,8093224821226421910,131072 /prefetch:8
        5⤵
        
        PID:4468
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3368 --field-trial-handle=1828,i,4382803057602350276,8093224821226421910,131072 /prefetch:8
        5⤵
        
        PID:1044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 664 -ip 664
1⤵
PID:812

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3424 -ip 3424
1⤵
PID:2604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4124

C:\Program Files (x86)\GameSyncLink\GameService.exe
"C:\Program Files (x86)\GameSyncLink\GameService.exe"
1⤵
PID:3608
- C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
  "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
  2⤵
  PID:2004
- - C:\Windows\Temp\434962.exe
    "C:\Windows\Temp\434962.exe" --list-devices
    3⤵
    PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion