asyncrat | 6b81b36622febc198dbe4596349b7b781cd6b278e9db9145a2de8b14b045e128

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000c000000025727-23777.dat	family_asyncrat

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	$77-Bitdefender.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\""	$77-Bitdefender.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\375C63.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ApiUpdater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\""	ApiUpdater.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
7040	powershell.exe
4144	powershell.exe
1096	powershell.exe
5016	powershell.exe
3000	powershell.exe
1764	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Downloads MZ/PE file 23 IoCs

flow	pid	Process
611	3976	New Text Document.exe
625	3976	New Text Document.exe
625	3976	New Text Document.exe
423	3976	New Text Document.exe
618	3976	New Text Document.exe
630	3976	New Text Document.exe
428	3976	New Text Document.exe
484	3976	New Text Document.exe
412	3976	New Text Document.exe
600	3976	New Text Document.exe
602	3976	New Text Document.exe
603	3976	New Text Document.exe
636	3976	New Text Document.exe
416	3976	New Text Document.exe
416	3976	New Text Document.exe
608	3976	New Text Document.exe
608	3976	New Text Document.exe
608	3976	New Text Document.exe
479	3976	New Text Document.exe
634	3976	New Text Document.exe
598	3976	New Text Document.exe
610	3976	New Text Document.exe
615	3976	New Text Document.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1492	netsh.exe
1448	netsh.exe
4044	netsh.exe

A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	ApiUpdater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	windows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	vapo.exe

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Security Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Security Update.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\67364a37f43593883a7b70eb2426799aWindows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\67364a37f43593883a7b70eb2426799aWindows Update.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update(32bit).lnk	e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update(32bit).lnk	e.exe

Executes dropped EXE 64 IoCs

pid	Process
1140	updater.exe
2620	Discord.exe
3544	noyjhoadw.exe
1032	update.exe
2472	build.exe
4580	powerstealer.exe
836	fag3.exe
672	fag.exe
1100	Server.exe
3696	server.exe
1844	StUpdate.exe
772	e.exe
572	payload.exe
1000	abc.exe
2400	StUpdate.exe
4448	Java Update(32bit).exe
3808	Java Update(32bit).exe
5480	StUpdate.exe
5648	Java Update(32bit).exe
6964	StUpdate.exe
7096	Java Update(32bit).exe
4012	StUpdate.exe
4196	Java Update(32bit).exe
5996	StUpdate.exe
5324	done.exe
7024	sampcac-loader.exe
7036	Loader.exe
6020	15.exe
6216	traf.exe
6488	sel1.exe
6544	vapo.exe
5560	amada2.exe
5704	gdsun.exe
6200	1.exe
6812	Update.exe
6028	test.exe
6944	BQEHIQAG.exe
6624	BQEHIQAG.exe
6756	DBDownloader.exe
5432	DBDownloader.exe
5128	rh_0-8_2025-01-23_15-05.exe
2276	ApiUpdater.exe
3064	windows.exe
6420	T.exe
5248	Enalib.exe
1304	$77-Bitdefender.exe
244	36.exe
6220	access.exe
6248	system.exe
1336	Surrey.com
1640	Java Update(32bit).exe
4876	StUpdate.exe
6088	vapo.exe
4648	vapo.exe
6516	Java Update(32bit).exe
6236	StUpdate.exe
524	vapo.exe
1852	Java Update(32bit).exe
4340	StUpdate.exe
4176	vapo.exe
2864	Java Update(32bit).exe
5672	StUpdate.exe
3576	vapo.exe
5524	Java Update(32bit).exe

Loads dropped DLL 18 IoCs

pid	Process
6624	BQEHIQAG.exe
6756	DBDownloader.exe
6756	DBDownloader.exe
6756	DBDownloader.exe
6756	DBDownloader.exe
6756	DBDownloader.exe
6756	DBDownloader.exe
6756	DBDownloader.exe
6756	DBDownloader.exe
5432	DBDownloader.exe
5432	DBDownloader.exe
5432	DBDownloader.exe
5432	DBDownloader.exe
5432	DBDownloader.exe
5432	DBDownloader.exe
5432	DBDownloader.exe
5432	DBDownloader.exe
5432	DBDownloader.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Update(32bit) = "C:\\ProgramData\\Java Update(32bit).exe"	e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\""	ApiUpdater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\""	ApiUpdater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\""	$77-Bitdefender.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\""	$77-Bitdefender.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs

Web Service

T1102

flow	ioc
834	pastebin.com
917	pastebin.com
1662	pastebin.com
2066	pastebin.com
2605	pastebin.com
2707	pastebin.com
2917	pastebin.com
2761	pastebin.com
1640	pastebin.com
1726	pastebin.com
1752	pastebin.com
1881	pastebin.com
2350	pastebin.com
2376	pastebin.com
2650	pastebin.com
2775	pastebin.com
883	pastebin.com
1307	pastebin.com
1517	pastebin.com
2466	pastebin.com
3144	pastebin.com
709	pastebin.com
1341	pastebin.com
1581	pastebin.com
1602	pastebin.com
1763	pastebin.com
899	pastebin.com
1220	pastebin.com
1362	pastebin.com
1503	pastebin.com
2031	pastebin.com
2042	pastebin.com
2193	pastebin.com
3176	pastebin.com
3401	pastebin.com
981	pastebin.com
1250	pastebin.com
1414	pastebin.com
711	pastebin.com
787	pastebin.com
828	pastebin.com
1672	pastebin.com
2958	pastebin.com
1227	pastebin.com
2458	pastebin.com
2549	pastebin.com
775	pastebin.com
2281	pastebin.com
2380	pastebin.com
3220	pastebin.com
3291	pastebin.com
783	pastebin.com
1050	pastebin.com
762	pastebin.com
825	pastebin.com
1271	pastebin.com
1395	pastebin.com
1909	pastebin.com
1943	pastebin.com
2361	pastebin.com
2392	pastebin.com
2472	pastebin.com
2620	pastebin.com
2715	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
494	ip-api.com

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

persistence privilege_escalation

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	sel1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	sel1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	traf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	traf.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\update.exe	updater.exe
File opened for modification	C:\Windows\system32\update.exe	updater.exe
File opened for modification	C:\Windows\system32\update.exe	update.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
7092	tasklist.exe
5524	tasklist.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1304 set thread context of 3492	1304	$77-Bitdefender.exe	307
PID 5432 set thread context of 5608	5432	DBDownloader.exe	287

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\TransferRare	1.exe
File opened for modification	C:\Windows\EscortsNascar	1.exe
File opened for modification	C:\Windows\NavyPromising	1.exe
File opened for modification	C:\Windows\HonoluluSyndrome	1.exe
File opened for modification	C:\Windows\OxfordPrintable	1.exe
File opened for modification	C:\Windows\ViBases	1.exe
File opened for modification	C:\Windows\ImmediatelyBros	1.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	\??\c:\programdata\1be588a5b7\gdsun.exe:Zone.Identifier	amada2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
5584	6020	WerFault.exe	260
1588	5128	WerFault.exe	286
4856	6548	WerFault.exe	282
5000	244	WerFault.exe	310
1796	3904	WerFault.exe	320

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	traf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DBDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ApiUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	T.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$77-Bitdefender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	36.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	noyjhoadw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DBDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	done.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdsun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	access.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Surrey.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amada2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4736	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133824912700205498"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	ApiUpdater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3350944739-639801879-157714471-1000\{C7D6FC17-5E87-4A77-A18E-DF890905840A}	chrome.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

pid	Process
5740	reg.exe
4860	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\1be588a5b7\gdsun.exe:Zone.Identifier	amada2.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2796	schtasks.exe
3808	schtasks.exe
1688	schtasks.exe
4028	schtasks.exe
1952	schtasks.exe
1304	schtasks.exe
6724	schtasks.exe
6744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2800	chrome.exe
2800	chrome.exe
1628	msedge.exe
1628	msedge.exe
5020	msedge.exe
5020	msedge.exe
3684	identity_helper.exe
3684	identity_helper.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe
3696	server.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3696	server.exe
772	e.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
6488	sel1.exe
6488	sel1.exe
1304	$77-Bitdefender.exe
5432	DBDownloader.exe
6216	traf.exe
6216	traf.exe
5608	cmd.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
4820	firefox.exe
1032	update.exe
4580	powerstealer.exe
772	e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 3340	2800	chrome.exe	109
PID 2800 wrote to memory of 3340	2800	chrome.exe	109
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 3944	2800	chrome.exe	110
PID 2800 wrote to memory of 5000	2800	chrome.exe	111
PID 2800 wrote to memory of 5000	2800	chrome.exe	111
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112
PID 2800 wrote to memory of 4988	2800	chrome.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3028
- C:\Windows\SysWOW64\fontdrvhost.exe
  "C:\Windows\System32\fontdrvhost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1636

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\New Text Document.exe.zip"
1⤵
PID:2024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff8b88cc40,0x7fff8b88cc4c,0x7fff8b88cc58
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1756,i,8206421418706393078,2097163389112412907,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1740 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1964,i,8206421418706393078,2097163389112412907,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1988 /prefetch:3
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2296,i,8206421418706393078,2097163389112412907,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,8206421418706393078,2097163389112412907,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,8206421418706393078,2097163389112412907,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3688,i,8206421418706393078,2097163389112412907,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4764,i,8206421418706393078,2097163389112412907,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5072,i,8206421418706393078,2097163389112412907,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3812,i,8206421418706393078,2097163389112412907,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4688,i,8206421418706393078,2097163389112412907,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3348,i,8206421418706393078,2097163389112412907,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4632,i,8206421418706393078,2097163389112412907,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4616 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4656,i,8206421418706393078,2097163389112412907,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3408 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4472

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff8b7446f8,0x7fff8b744708,0x7fff8b744718
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,1782922734088753936,8190268407312490967,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,1782922734088753936,8190268407312490967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,1782922734088753936,8190268407312490967,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1782922734088753936,8190268407312490967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1782922734088753936,8190268407312490967,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1782922734088753936,8190268407312490967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1782922734088753936,8190268407312490967,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2904 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,1782922734088753936,8190268407312490967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,1782922734088753936,8190268407312490967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1782922734088753936,8190268407312490967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1782922734088753936,8190268407312490967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1782922734088753936,8190268407312490967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1782922734088753936,8190268407312490967,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1782922734088753936,8190268407312490967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1782922734088753936,8190268407312490967,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1868

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1404
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2012 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {393eae4e-f2e8-4002-bace-e343bc6aa896} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" gpu
    3⤵
    PID:1432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2400 -prefMapHandle 2388 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d61c74f0-7cad-4db0-9ae6-f9e66a4d17e3} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" socket
    3⤵
    - Checks processor information in registry
    PID:4984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3056 -childID 1 -isForBrowser -prefsHandle 3044 -prefMapHandle 3160 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ce62349-e634-492e-ae02-113a9180fa63} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" tab
    3⤵
    PID:648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4272 -childID 2 -isForBrowser -prefsHandle 4264 -prefMapHandle 4260 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54beb99a-2aef-44bf-b60b-e955182855b9} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" tab
    3⤵
    PID:2328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4876 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4868 -prefMapHandle 4864 -prefsLen 32551 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6df3a1b3-2da7-4a49-8bb6-661a8afd21c3} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" utility
    3⤵
    - Checks processor information in registry
    PID:2104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5264 -childID 3 -isForBrowser -prefsHandle 2800 -prefMapHandle 5220 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6da7a96e-645a-49d8-99ff-6d594a82e560} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" tab
    3⤵
    PID:464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5412 -childID 4 -isForBrowser -prefsHandle 5492 -prefMapHandle 5488 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ab6975a-1633-413c-b317-b3f6b205fbb8} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" tab
    3⤵
    PID:1020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5632 -childID 5 -isForBrowser -prefsHandle 5396 -prefMapHandle 5400 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b63264a-6471-4fa4-bf94-c7a1629679ea} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" tab
    3⤵
    PID:3684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6212 -childID 6 -isForBrowser -prefsHandle 6056 -prefMapHandle 6044 -prefsLen 27228 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e955ac75-0929-4c13-88ea-ff1f335c2ae5} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" tab
    3⤵
    PID:3624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6356 -childID 7 -isForBrowser -prefsHandle 6364 -prefMapHandle 6368 -prefsLen 27228 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2af720a3-0e0d-4c6a-a3d9-9b59654b6203} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" tab
    3⤵
    PID:1168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6704 -parentBuildID 20240401114208 -prefsHandle 6200 -prefMapHandle 6740 -prefsLen 33049 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c5ad9ab-8493-4708-86ac-989dda45ee85} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" rdd
    3⤵
    PID:1656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3680 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 4564 -prefMapHandle 6568 -prefsLen 33049 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91080799-79ef-48cf-8e8e-f4d305d4eb11} 4820 "\\.\pipe\gecko-crash-server-pipe.4820" utility
    3⤵
    - Checks processor information in registry
    PID:1564

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3460

C:\Users\Admin\Desktop\New Text Document.exe
"C:\Users\Admin\Desktop\New Text Document.exe"
1⤵
- Downloads MZ/PE file
PID:3976
- C:\Users\Admin\Desktop\a\updater.exe
  "C:\Users\Admin\Desktop\a\updater.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1140
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Runtime Broker.exe" /sc ONLOGON /tr "C:\Windows\system32\update.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2796
- - C:\Windows\system32\update.exe
    "C:\Windows\system32\update.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:1032
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "Runtime Broker.exe" /sc ONLOGON /tr "C:\Windows\system32\update.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1688
- C:\Users\Admin\Desktop\a\Discord.exe
  "C:\Users\Admin\Desktop\a\Discord.exe"
  2⤵
  - Executes dropped EXE
  PID:2620
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\powerstealer.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3808
- - C:\Users\Admin\AppData\Roaming\SubDir\powerstealer.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\powerstealer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4580
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\powerstealer.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4028
- C:\Users\Admin\Desktop\a\noyjhoadw.exe
  "C:\Users\Admin\Desktop\a\noyjhoadw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3544
- C:\Users\Admin\Desktop\a\build.exe
  "C:\Users\Admin\Desktop\a\build.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2472
- C:\Users\Admin\Desktop\a\fag3.exe
  "C:\Users\Admin\Desktop\a\fag3.exe"
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Users\Admin\Desktop\a\fag.exe
  "C:\Users\Admin\Desktop\a\fag.exe"
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Users\Admin\Desktop\a\Server.exe
  "C:\Users\Admin\Desktop\a\Server.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1100
- - C:\Users\Admin\AppData\Local\Temp\server.exe
    "C:\Users\Admin\AppData\Local\Temp\server.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3696
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1492
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1448
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4044
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1952
- C:\Users\Admin\Desktop\a\e.exe
  "C:\Users\Admin\Desktop\a\e.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\a\e.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'e.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Java Update(32bit).exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Java Update(32bit).exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3000
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Java Update(32bit)" /tr "C:\ProgramData\Java Update(32bit).exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1304
- C:\Users\Admin\Desktop\a\payload.exe
  "C:\Users\Admin\Desktop\a\payload.exe"
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Users\Admin\Desktop\a\abc.exe
  "C:\Users\Admin\Desktop\a\abc.exe"
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Users\Admin\Desktop\a\done.exe
  "C:\Users\Admin\Desktop\a\done.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5324
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath "C:\timfw"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:1764
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:7040
- C:\Users\Admin\Desktop\a\sampcac-loader.exe
  "C:\Users\Admin\Desktop\a\sampcac-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:7024
- C:\Users\Admin\Desktop\a\Loader.exe
  "C:\Users\Admin\Desktop\a\Loader.exe"
  2⤵
  - Executes dropped EXE
  PID:7036
- C:\Users\Admin\Desktop\a\15.exe
  "C:\Users\Admin\Desktop\a\15.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 364
    3⤵
    - Program crash
    PID:5584
- C:\Users\Admin\Desktop\a\traf.exe
  "C:\Users\Admin\Desktop\a\traf.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  PID:6216
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3904
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1452
      4⤵
      Program crash
      PID:1796
- C:\Users\Admin\Desktop\a\sel1.exe
  "C:\Users\Admin\Desktop\a\sel1.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Suspicious behavior: MapViewOfSection
  PID:6488
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Adds policy Run key to start application
    - System Location Discovery: System Language Discovery
    PID:6548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6548 -s 232
      4⤵
      Program crash
      PID:4856
- C:\Users\Admin\Desktop\a\vapo.exe
  "C:\Users\Admin\Desktop\a\vapo.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:6544
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "vapo" /tr "C:\Users\Admin\AppData\Roaming\vapo.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6724
- C:\Users\Admin\Desktop\a\amada2.exe
  "C:\Users\Admin\Desktop\a\amada2.exe"
  2⤵
  - Executes dropped EXE
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:5560
- - \??\c:\programdata\1be588a5b7\gdsun.exe
    c:\programdata\1be588a5b7\gdsun.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5704
  - - C:\Windows\SysWOW64\REG.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\1be588a5b7
      4⤵
      System Location Discovery: System Language Discovery
      PID:4656
- C:\Users\Admin\Desktop\a\1.exe
  "C:\Users\Admin\Desktop\a\1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:6200
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy Universities Universities.cmd & Universities.cmd
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5276
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:5524
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "opssvc wrsa"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5516
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:7092
  - - C:\Windows\SysWOW64\findstr.exe
      findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5864
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 634977
      4⤵
      System Location Discovery: System Language Discovery
      PID:3776
  - - C:\Windows\SysWOW64\extrac32.exe
      extrac32 /Y /E Gtk
      4⤵
      System Location Discovery: System Language Discovery
      PID:7084
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "Constitution" Wagon
      4⤵
      PID:2296
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b 634977\Surrey.com + Firewire + Values + Expanding + Representing + Gothic + Voltage + Refinance + Nec + Kate 634977\Surrey.com
      4⤵
      System Location Discovery: System Language Discovery
      PID:6716
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Courage + ..\Remove + ..\Throws + ..\Competing Q
      4⤵
      System Location Discovery: System Language Discovery
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\634977\Surrey.com
      Surrey.com Q
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1336
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      System Location Discovery: System Language Discovery
      PID:5760
- C:\Users\Admin\Desktop\a\Update.exe
  "C:\Users\Admin\Desktop\a\Update.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6812
- C:\Users\Admin\Desktop\a\test.exe
  "C:\Users\Admin\Desktop\a\test.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6028
- C:\Users\Admin\Desktop\a\BQEHIQAG.exe
  "C:\Users\Admin\Desktop\a\BQEHIQAG.exe"
  2⤵
  - Executes dropped EXE
  PID:6944
- - C:\Windows\Temp\{B759938A-E758-42A9-ADDF-67C88EE05013}\.cr\BQEHIQAG.exe
    "C:\Windows\Temp\{B759938A-E758-42A9-ADDF-67C88EE05013}\.cr\BQEHIQAG.exe" -burn.clean.room="C:\Users\Admin\Desktop\a\BQEHIQAG.exe" -burn.filehandle.attached=568 -burn.filehandle.self=576
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6624
  - - C:\Windows\Temp\{05BFFFA1-E415-4544-AA35-DB44C663AAD4}\.ba\DBDownloader.exe
      C:\Windows\Temp\{05BFFFA1-E415-4544-AA35-DB44C663AAD4}\.ba\DBDownloader.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:6756
    - - C:\Users\Admin\AppData\Roaming\Helpdemo_vqz_test\DBDownloader.exe
        
        C:\Users\Admin\AppData\Roaming\Helpdemo_vqz_test\DBDownloader.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:5432
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:5608
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
- C:\Users\Admin\Desktop\a\rh_0-8_2025-01-23_15-05.exe
  "C:\Users\Admin\Desktop\a\rh_0-8_2025-01-23_15-05.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  PID:5128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5128 -s 376
    3⤵
    - Program crash
    PID:1588
- C:\Users\Admin\Desktop\a\ApiUpdater.exe
  "C:\Users\Admin\Desktop\a\ApiUpdater.exe"
  2⤵
  - Adds policy Run key to start application
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2276
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    PID:4104
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4860
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    PID:4380
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Bitdefender\$77-Bitdefender.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4748
    - - C:\ProgramData\Bitdefender\$77-Bitdefender.exe
        
        C:\ProgramData\Bitdefender\$77-Bitdefender.exe
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1304
      - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5388
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        UAC bypass
        Modifies registry key
        
        PID:5740
      - \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        6⤵
        
        PID:3492
- C:\Users\Admin\Desktop\a\windows.exe
  "C:\Users\Admin\Desktop\a\windows.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3064
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "system" /tr '"C:\Users\Admin\AppData\Roaming\system.exe"' & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5596
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "system" /tr '"C:\Users\Admin\AppData\Roaming\system.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:6744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE3E2.tmp.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7056
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4736
  - - C:\Users\Admin\AppData\Roaming\system.exe
      "C:\Users\Admin\AppData\Roaming\system.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6248
- C:\Users\Admin\Desktop\a\T.exe
  "C:\Users\Admin\Desktop\a\T.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6420
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
    "Powershell.exe" -exec bypass -c Copy-Item 'C:\Users\Admin\Desktop\a\T.exe' 'C:\ProgramData\1be588a5b7\T.exe' -Force
    3⤵
    PID:5320
- C:\Users\Admin\Desktop\a\Enalib.exe
  "C:\Users\Admin\Desktop\a\Enalib.exe"
  2⤵
  - Executes dropped EXE
  PID:5248
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
    "Powershell.exe" -exec bypass -c Copy-Item 'C:\Users\Admin\Desktop\a\Enalib.exe' 'C:\ProgramData\1be588a5b7\Enalib.exe' -Force
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2220
- C:\Users\Admin\Desktop\a\36.exe
  "C:\Users\Admin\Desktop\a\36.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 244 -s 216
    3⤵
    - Program crash
    PID:5000
- C:\Users\Admin\Desktop\a\access.exe
  "C:\Users\Admin\Desktop\a\access.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6220

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1844

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2400

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
- Executes dropped EXE
PID:4448

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
- Executes dropped EXE
PID:3808

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- Executes dropped EXE
PID:5480

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
- Executes dropped EXE
PID:5648

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6964

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
- Executes dropped EXE
PID:7096

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4012

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
- Executes dropped EXE
PID:4196

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- Executes dropped EXE
PID:5996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6020 -ip 6020
1⤵
PID:5548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5128 -ip 5128
1⤵
PID:6796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6548 -ip 6548
1⤵
PID:6276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 244 -ip 244
1⤵
PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3904 -ip 3904
1⤵
PID:5872

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
- Executes dropped EXE
PID:1640

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4876

C:\Users\Admin\AppData\Roaming\vapo.exe
C:\Users\Admin\AppData\Roaming\vapo.exe
1⤵
- Executes dropped EXE
PID:6088

C:\Users\Admin\AppData\Roaming\vapo.exe
C:\Users\Admin\AppData\Roaming\vapo.exe
1⤵
- Executes dropped EXE
PID:4648

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
- Executes dropped EXE
PID:6516

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- Executes dropped EXE
PID:6236

C:\Users\Admin\AppData\Roaming\vapo.exe
C:\Users\Admin\AppData\Roaming\vapo.exe
1⤵
- Executes dropped EXE
PID:524

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
- Executes dropped EXE
PID:1852

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4340

C:\Users\Admin\AppData\Roaming\vapo.exe
C:\Users\Admin\AppData\Roaming\vapo.exe
1⤵
- Executes dropped EXE
PID:4176

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
- Executes dropped EXE
PID:2864

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- Executes dropped EXE
PID:5672

C:\Users\Admin\AppData\Roaming\vapo.exe
C:\Users\Admin\AppData\Roaming\vapo.exe
1⤵
- Executes dropped EXE
PID:3576

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
- Executes dropped EXE
PID:5524

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- System Location Discovery: System Language Discovery
PID:6404

C:\Users\Admin\AppData\Roaming\vapo.exe
C:\Users\Admin\AppData\Roaming\vapo.exe
1⤵
PID:4016

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
PID:1388

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
PID:3456

C:\Users\Admin\AppData\Roaming\vapo.exe
C:\Users\Admin\AppData\Roaming\vapo.exe
1⤵
PID:4884

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
PID:6924

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- System Location Discovery: System Language Discovery
PID:6468

C:\Users\Admin\AppData\Roaming\vapo.exe
C:\Users\Admin\AppData\Roaming\vapo.exe
1⤵
PID:4724

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
PID:6488

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- System Location Discovery: System Language Discovery
PID:4828

C:\Users\Admin\AppData\Roaming\vapo.exe
C:\Users\Admin\AppData\Roaming\vapo.exe
1⤵
PID:6176

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
PID:2812

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
PID:3120

C:\Users\Admin\AppData\Roaming\vapo.exe
C:\Users\Admin\AppData\Roaming\vapo.exe
1⤵
PID:5528

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
PID:6764

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
PID:6656

C:\Users\Admin\AppData\Roaming\vapo.exe
C:\Users\Admin\AppData\Roaming\vapo.exe
1⤵
PID:6864

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
PID:5508

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
PID:6580

C:\Users\Admin\AppData\Roaming\vapo.exe
C:\Users\Admin\AppData\Roaming\vapo.exe
1⤵
PID:6216

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
PID:5284

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- System Location Discovery: System Language Discovery
PID:3280

C:\Users\Admin\AppData\Roaming\vapo.exe
C:\Users\Admin\AppData\Roaming\vapo.exe
1⤵
PID:1964

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
PID:556

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
PID:4696

C:\Users\Admin\AppData\Roaming\vapo.exe
C:\Users\Admin\AppData\Roaming\vapo.exe
1⤵
PID:5160

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
PID:6616

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- System Location Discovery: System Language Discovery
PID:3200

C:\Users\Admin\AppData\Roaming\vapo.exe
C:\Users\Admin\AppData\Roaming\vapo.exe
1⤵
PID:3088

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
PID:2692

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- System Location Discovery: System Language Discovery
PID:2440

C:\Users\Admin\AppData\Roaming\vapo.exe
C:\Users\Admin\AppData\Roaming\vapo.exe
1⤵
PID:4280

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
PID:3040

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
PID:6932

C:\Users\Admin\AppData\Roaming\vapo.exe
C:\Users\Admin\AppData\Roaming\vapo.exe
1⤵
PID:4444

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
PID:4492

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
PID:6092

C:\Users\Admin\AppData\Roaming\vapo.exe
C:\Users\Admin\AppData\Roaming\vapo.exe
1⤵
PID:3100

C:\ProgramData\Java Update(32bit).exe
"C:\ProgramData\Java Update(32bit).exe"
1⤵
PID:3672

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- System Location Discovery: System Language Discovery
PID:5332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery