dcrat | 93fe21dbb3bb181c61b9c3f40abd04130f83bf7ce906ba73394045896c5019fc

pid	Process
4508	chrome.exe
4400	chrome.exe
5400	chrome.exe
5756	chrome.exe
5308	chrome.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

persistence privilege_escalation

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	Webruntime.exe

Executes dropped EXE 4 IoCs

pid	Process
3452	1.exe
2092	2.exe
4552	Webruntime.exe
4748	lsass.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ipinfo.io
8	ipinfo.io
15	ip-api.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sysmon.exe	Webruntime.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\121e5b5079f7c0	Webruntime.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5696	cmd.exe
4000	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	1.exe

Delays execution with timeout.exe 25 IoCs

defense_evasion

pid	Process
3644	timeout.exe
216	timeout.exe
5696	timeout.exe
3636	timeout.exe
2924	timeout.exe
2352	timeout.exe
1504	timeout.exe
4672	timeout.exe
5144	timeout.exe
3528	timeout.exe
1884	timeout.exe
5672	timeout.exe
4424	timeout.exe
4456	timeout.exe
3616	timeout.exe
3972	timeout.exe
4472	timeout.exe
2504	timeout.exe
3892	timeout.exe
4540	timeout.exe
5972	timeout.exe
1616	timeout.exe
3472	timeout.exe
3940	timeout.exe
4916	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
5172	taskkill.exe
2280	taskkill.exe
2352	taskkill.exe
2592	taskkill.exe
2288	taskkill.exe
724	taskkill.exe
540	taskkill.exe
368	taskkill.exe
2756	taskkill.exe
540	taskkill.exe
4340	taskkill.exe
6008	taskkill.exe
2384	taskkill.exe
2504	taskkill.exe
1704	taskkill.exe
4552	taskkill.exe
5344	taskkill.exe
5072	taskkill.exe
2996	taskkill.exe
432	taskkill.exe
1564	taskkill.exe
4352	taskkill.exe
1304	taskkill.exe
2664	taskkill.exe
2300	taskkill.exe
4792	taskkill.exe
3972	taskkill.exe
4964	taskkill.exe
3004	taskkill.exe
5096	taskkill.exe
2200	taskkill.exe
4744	taskkill.exe
1444	taskkill.exe
4984	taskkill.exe
4484	taskkill.exe
400	taskkill.exe
3120	taskkill.exe
5760	taskkill.exe
2592	taskkill.exe
3212	taskkill.exe
2416	taskkill.exe
1396	taskkill.exe
2620	taskkill.exe
1900	taskkill.exe
5168	taskkill.exe
3756	taskkill.exe
4924	taskkill.exe
4872	taskkill.exe
6120	taskkill.exe
688	taskkill.exe
6024	taskkill.exe
2416	taskkill.exe
3912	taskkill.exe
5140	taskkill.exe
2132	taskkill.exe
4092	taskkill.exe
2284	taskkill.exe
1016	taskkill.exe
844	taskkill.exe
2808	taskkill.exe
3980	taskkill.exe
3364	taskkill.exe
6036	taskkill.exe
5548	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings	Webruntime.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
552	powershell.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe
4552	Webruntime.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	2.exe
Token: SeDebugPrivilege	4552	Webruntime.exe
Token: SeDebugPrivilege	552	powershell.exe
Token: SeDebugPrivilege	3452	1.exe
Token: SeDebugPrivilege	3364	taskkill.exe
Token: SeDebugPrivilege	5772	taskkill.exe
Token: SeDebugPrivilege	1068	taskkill.exe
Token: SeDebugPrivilege	6100	taskkill.exe
Token: SeDebugPrivilege	2592	taskkill.exe
Token: SeDebugPrivilege	6020	taskkill.exe
Token: SeDebugPrivilege	2300	taskkill.exe
Token: SeDebugPrivilege	5856	taskkill.exe
Token: SeDebugPrivilege	2260	taskkill.exe
Token: SeDebugPrivilege	3532	taskkill.exe
Token: SeDebugPrivilege	4748	lsass.exe
Token: SeDebugPrivilege	1036	taskkill.exe
Token: SeDebugPrivilege	4572	taskkill.exe
Token: SeDebugPrivilege	4812	taskkill.exe
Token: SeDebugPrivilege	400	taskkill.exe
Token: SeDebugPrivilege	3140	taskkill.exe
Token: SeDebugPrivilege	100	taskkill.exe
Token: SeDebugPrivilege	5116	taskkill.exe
Token: SeDebugPrivilege	5928	taskkill.exe
Token: SeDebugPrivilege	3236	taskkill.exe
Token: SeDebugPrivilege	4088	taskkill.exe
Token: SeShutdownPrivilege	5308	chrome.exe
Token: SeCreatePagefilePrivilege	5308	chrome.exe
Token: SeShutdownPrivilege	5308	chrome.exe
Token: SeCreatePagefilePrivilege	5308	chrome.exe
Token: SeShutdownPrivilege	5308	chrome.exe
Token: SeCreatePagefilePrivilege	5308	chrome.exe
Token: SeShutdownPrivilege	5308	chrome.exe
Token: SeCreatePagefilePrivilege	5308	chrome.exe
Token: SeDebugPrivilege	4924	taskkill.exe
Token: SeDebugPrivilege	4716	taskkill.exe
Token: SeDebugPrivilege	4800	taskkill.exe
Token: SeDebugPrivilege	5072	taskkill.exe
Token: SeDebugPrivilege	4792	taskkill.exe
Token: SeDebugPrivilege	4900	taskkill.exe
Token: SeDebugPrivilege	1396	taskkill.exe
Token: SeDebugPrivilege	5180	taskkill.exe
Token: SeDebugPrivilege	2612	taskkill.exe
Token: SeDebugPrivilege	4856	taskkill.exe
Token: SeDebugPrivilege	4552	taskkill.exe
Token: SeDebugPrivilege	2352	taskkill.exe
Token: SeDebugPrivilege	2288	taskkill.exe
Token: SeDebugPrivilege	4832	taskkill.exe
Token: SeDebugPrivilege	836	taskkill.exe
Token: SeDebugPrivilege	4340	taskkill.exe
Token: SeDebugPrivilege	5448	taskkill.exe
Token: SeDebugPrivilege	2044	taskkill.exe
Token: SeDebugPrivilege	2592	taskkill.exe
Token: SeDebugPrivilege	1700	taskkill.exe
Token: SeDebugPrivilege	4840	taskkill.exe
Token: SeDebugPrivilege	2564	taskkill.exe
Token: SeDebugPrivilege	4452	taskkill.exe
Token: SeDebugPrivilege	3404	taskkill.exe
Token: SeDebugPrivilege	2684	taskkill.exe
Token: SeDebugPrivilege	2636	taskkill.exe
Token: SeDebugPrivilege	1900	taskkill.exe
Token: SeDebugPrivilege	1016	taskkill.exe
Token: SeDebugPrivilege	3588	taskkill.exe
Token: SeDebugPrivilege	4312	taskkill.exe
Token: SeDebugPrivilege	4072	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5308	chrome.exe
5308	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 1028	4308	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	87
PID 4308 wrote to memory of 1028	4308	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	87
PID 4308 wrote to memory of 1028	4308	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	87
PID 4308 wrote to memory of 3452	4308	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	90
PID 4308 wrote to memory of 3452	4308	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	90
PID 4308 wrote to memory of 3452	4308	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	90
PID 4308 wrote to memory of 2092	4308	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	91
PID 4308 wrote to memory of 2092	4308	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	91
PID 4308 wrote to memory of 4552	4308	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	92
PID 4308 wrote to memory of 4552	4308	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	92
PID 1028 wrote to memory of 552	1028	cmd.exe	93
PID 1028 wrote to memory of 552	1028	cmd.exe	93
PID 1028 wrote to memory of 552	1028	cmd.exe	93
PID 4552 wrote to memory of 5068	4552	Webruntime.exe	94
PID 4552 wrote to memory of 5068	4552	Webruntime.exe	94
PID 5068 wrote to memory of 4984	5068	cmd.exe	96
PID 5068 wrote to memory of 4984	5068	cmd.exe	96
PID 3452 wrote to memory of 5696	3452	1.exe	97
PID 3452 wrote to memory of 5696	3452	1.exe	97
PID 3452 wrote to memory of 5696	3452	1.exe	97
PID 1028 wrote to memory of 3364	1028	cmd.exe	99
PID 1028 wrote to memory of 3364	1028	cmd.exe	99
PID 1028 wrote to memory of 3364	1028	cmd.exe	99
PID 5696 wrote to memory of 4348	5696	cmd.exe	101
PID 5696 wrote to memory of 4348	5696	cmd.exe	101
PID 5696 wrote to memory of 4348	5696	cmd.exe	101
PID 5696 wrote to memory of 4000	5696	cmd.exe	102
PID 5696 wrote to memory of 4000	5696	cmd.exe	102
PID 5696 wrote to memory of 4000	5696	cmd.exe	102
PID 5068 wrote to memory of 2396	5068	cmd.exe	103
PID 5068 wrote to memory of 2396	5068	cmd.exe	103
PID 5696 wrote to memory of 5488	5696	cmd.exe	104
PID 5696 wrote to memory of 5488	5696	cmd.exe	104
PID 5696 wrote to memory of 5488	5696	cmd.exe	104
PID 1028 wrote to memory of 5772	1028	cmd.exe	105
PID 1028 wrote to memory of 5772	1028	cmd.exe	105
PID 1028 wrote to memory of 5772	1028	cmd.exe	105
PID 1028 wrote to memory of 1068	1028	cmd.exe	106
PID 1028 wrote to memory of 1068	1028	cmd.exe	106
PID 1028 wrote to memory of 1068	1028	cmd.exe	106
PID 3452 wrote to memory of 408	3452	1.exe	107
PID 3452 wrote to memory of 408	3452	1.exe	107
PID 3452 wrote to memory of 408	3452	1.exe	107
PID 408 wrote to memory of 5232	408	cmd.exe	109
PID 408 wrote to memory of 5232	408	cmd.exe	109
PID 408 wrote to memory of 5232	408	cmd.exe	109
PID 408 wrote to memory of 2976	408	cmd.exe	110
PID 408 wrote to memory of 2976	408	cmd.exe	110
PID 408 wrote to memory of 2976	408	cmd.exe	110
PID 1028 wrote to memory of 6100	1028	cmd.exe	111
PID 1028 wrote to memory of 6100	1028	cmd.exe	111
PID 1028 wrote to memory of 6100	1028	cmd.exe	111
PID 1028 wrote to memory of 2592	1028	cmd.exe	112
PID 1028 wrote to memory of 2592	1028	cmd.exe	112
PID 1028 wrote to memory of 2592	1028	cmd.exe	112
PID 1028 wrote to memory of 6020	1028	cmd.exe	113
PID 1028 wrote to memory of 6020	1028	cmd.exe	113
PID 1028 wrote to memory of 6020	1028	cmd.exe	113
PID 1028 wrote to memory of 2300	1028	cmd.exe	114
PID 1028 wrote to memory of 2300	1028	cmd.exe	114
PID 1028 wrote to memory of 2300	1028	cmd.exe	114
PID 1028 wrote to memory of 5856	1028	cmd.exe	115
PID 1028 wrote to memory of 5856	1028	cmd.exe	115
PID 1028 wrote to memory of 5856	1028	cmd.exe	115

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe

C:\Users\Admin\AppData\Local\Temp\2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dllnet\1.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -window hidden -command ""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:552
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5772
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6020
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3532
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4812
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1396
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5180
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4856
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1700
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4456
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4312
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3892
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:2808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:2996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:3412
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - Kills process with taskkill
    PID:724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:5892
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:5172
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:5540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:5768
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    PID:4880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:4756
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:4744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:1320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:4424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:3452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:5460
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:400
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4968
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:4432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:2384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:1620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:1416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Kills process with taskkill
    PID:432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:4044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2860
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:3972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:4560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:1564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:4004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - Kills process with taskkill
    PID:4352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:4288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:5648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:5168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:3212
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:1968
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:3760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:1368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Kills process with taskkill
    PID:1444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:4496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:5804
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:6024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:5384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:1092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Kills process with taskkill
    PID:3912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:5276
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:5944
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:5072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:4964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:3232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:4932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:6060
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:4708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:4392
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:3124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:4584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:5140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Kills process with taskkill
    PID:6008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:4968
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:4432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:2384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:1620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:3584
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:3748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:1304
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:5340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:4840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2280
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:4452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:6120
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    PID:5000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:4288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:5648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Kills process with taskkill
    PID:5168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - Kills process with taskkill
    PID:3212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:3788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:4984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:2132
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:3364
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5144
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:3600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:1004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:3752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:3512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:3004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:4724
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:5344
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:6036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - Kills process with taskkill
    PID:2504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:3596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:5548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:1936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:5892
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:2416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:4720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:3824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - Kills process with taskkill
    PID:2664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Kills process with taskkill
    PID:1704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:4972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:4168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5852
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    PID:4900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:4740
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:1396
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:5180
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:3000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:1644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:3516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:5096
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:4552
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    PID:3124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:2204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:5596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:3140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:3132
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:5132
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:4844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:3480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5800
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:3088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Kills process with taskkill
    PID:3120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:1792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:5760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:4824
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    PID:4560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:5692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:6120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Kills process with taskkill
    PID:1900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Kills process with taskkill
    PID:2200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:2268
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:5640
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:3756
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:5524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:4036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Kills process with taskkill
    PID:688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:5856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3576
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:4484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:5804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2756
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:4884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Kills process with taskkill
    PID:5344
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:5192
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:3888
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:4904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:3912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Kills process with taskkill
    PID:540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - Kills process with taskkill
    PID:2416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:4520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:2880
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5672
- C:\Users\Admin\AppData\Local\Temp\dllnet\1.exe
  "C:\Users\Admin\AppData\Local\Temp\dllnet\1.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:3452
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5696
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:4348
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4000
  - - C:\Windows\SysWOW64\findstr.exe
      findstr All
      4⤵
      PID:5488
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:408
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:5232
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:2976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0x40,0x104,0x7fff783ddcf8,0x7fff783ddd04,0x7fff783ddd10
      4⤵
      PID:1824
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2000,i,16595343563706430374,3239624528945908668,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=1996 /prefetch:2
      4⤵
      PID:2700
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1572,i,16595343563706430374,3239624528945908668,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2208 /prefetch:3
      4⤵
      PID:2896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2412,i,16595343563706430374,3239624528945908668,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2572 /prefetch:8
      4⤵
      PID:5488
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3268,i,16595343563706430374,3239624528945908668,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3332 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3276,i,16595343563706430374,3239624528945908668,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3352 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4508
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4372,i,16595343563706430374,3239624528945908668,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4396 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:5400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4856,i,16595343563706430374,3239624528945908668,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4812 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5756
- C:\Users\Admin\AppData\Local\Temp\dllnet\2.exe
  "C:\Users\Admin\AppData\Local\Temp\dllnet\2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Users\Admin\AppData\Local\Temp\dllnet\Webruntime.exe
  "C:\Users\Admin\AppData\Local\Temp\dllnet\Webruntime.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LmfYfCqvHX.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4984
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:2396
  - - C:\Recovery\WindowsRE\lsass.exe
      "C:\Recovery\WindowsRE\lsass.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4748

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Authentication Process

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery